How do network policies work in Kubernetes, and how would you configure them to isolate sensitive workloads?