Administration and EXC service seperated on two LAN interfaces?

We would like to keep administration and general service of Exchange Servers seperate on two different LAN interfaces "A" and "B" (on "dual home" machines i.e. machines with two network interfaces).

Is this feasible so that no administration can be performed on LAN Interface A, all regular Exchange Service runs over LAN Interface A and all administration has to be done over B?

Reasoning for this is security - only certain people and machines would be granted access to the management LAN.

Any ideas how this is best achieved?

Thanks in advance