I think the parent meant, you have them on a subnet with no default route, but have a vpn / management system with one interface pointing in to the management n

I think the parent meant, you have them on a subnet with no default route, but have a vpn / management system with one interface pointing in to the management network. You can get in via the vpn but they can’t get out. It’s a pretty common configuration.