An organization wants to use network separation to eliminate exposure of the separated traffic to the entire ECS public network.

Which network separation method should they use?