Probably the simplest thing to do would be to just shut off the ports leading to external networks at the physical layer using management commands. They'd not b

Probably the simplest thing to do would be to just shut off the ports leading to external networks at the physical layer using management commands. They'd not be pingable from the outside, naturally, and it'd look like a cable cut (until you start doing TDR on the cable anyway), but they could bring it back online quickly once the powers that be choose to do so.