So Charlie are you saying that you can't just use Server Only mode?
If so why is that?
All machines on the "local" network are allowed to access the services on the server. For server-only, the only network available is the "local" network, and so any machines which share your subnet at the ISP will have more access than you want to allow.
server-only mode should not be deployed on public networks, as advised in the documentation and the console.
As Charlie said, a second, unused "local" NIC is the simple solution.