this would be best handled at the firewall/router. Perhaps even vlan restrictions.