Satellite server and Isolated Capsule server in separate and most restricted VLANs

Hi,

we are about to set up a Satellite server in our organisation,
in order to administer our future RHEL servers on VMs.

Our RHEL servers won't see the Internet beyond our firewall.
Our Satellite server will be allowed to connect to Red Hat's servers,
but not much else outside.
We certainly want to minimise on firewall rules,
both outgoing and incoming.
Actually we do have a rather strict regime here,
and I need to know in advance,
how to distribute the components into separate VLANs,
with the main target of least possible interconnectivity.
We want to get it pretty much right at the 1st shot.

I am aware of these documents:
- Planning for Red Hat Satellite
- Installing Satellite Server from a Connected Network

Is there anybody, who wants to share with us her/his diagrams, that reflect set-ups as described above?

Maybe somebody has a few advices for me as well.

I would be rather grateful to receive your responses.

Thanks for your time and all the best!
~JH