The proper way would be to create 2 distinct and non overlapping networks and then use a firewall to allow/restrict flows