An architect is designing a VMware Cloud Foundation 5.2 solution for a financial institution that requires absolute network isolation between its trading platform and its retail banking applications. Both application stacks must reside within the same VCF instance but must not share any vCenter Server or NSX Manager instances. What is the most appropriate design construct to meet these stringent isolation requirements?