you'd have one box in the internal network join 2 netmaker networks, 1 admin and 1 staff, and you'd set different egress rules for the nm networks