This was going to be my suggestion -

Isolate it in a VLAN, don’t create NAT rules for that VLAN. Just let it exist. Only allow inbound traffic from other VLANs if needed.