Easiest would be those devices to be placed in a dedicated subnet, and restrict access from it only as Michael suggested.

it may not be in your control, but you can always try to suggest that