Isolating JDE servers from rest of datacenter

Long story short: Our corporate masters are requiring a certain level of network/server security that our current JDE servers can't meet. We can't update our JDE environment because the business unit that is still using it is in flux and JDE will probably be just moved to wherever they move to and out of or zone.

The plan is to isolate the three JDE servers (deployment, weblogic, and FAT client) from the rest of our datacenter and only allow the necessary traffic to them and blocking everything else. We have an ISeries as our database/security services server and that will be staying in the general datacenter VLAN.