I have a secure subnet 172.20.40.0/24 but I have terminals where security can't be guaranteed and I have no control over protocol (Exam rooms, external user access). I'd like to set these up on a separate subnet to minimize attack vector however they will need access to one or two IP's on the secure subnet. I've setup a virtual pfsense firewall in between and at first was playing with using a LAN and A WAN with natting or VPN but am a bit out of my depth. What is the proper way to do this where I can secure this to minimal amount of network access.
EDIT
This is the list of the ports the application is hitting consisting of two servers ASDB (172.20.40.9) and ASDCFS (172.20.40.11). If the high risk terminal is say 172.20.40.100 what is the most elegant way I limit so it can only access those IP's and ports.