How would you implement network segmentation in a manufacturing plant running legacy, unpatchable systems at ADM?