It kind of depends on what services each device needs to access, but a guide has been put together that shows how to isolate a printer from accessing the internet. Part of this is done using IC2, but this can also be done locally by enabling VLANs.