Network isolation on Openshift 4.x with OVN Kubernetes CNI

Dear Community

We plan to deploy a single OCP Cluster to host multiple non prod environments ( dev, qas , uat etc ) .

we plan to use the Default OVN Kubernetes CNI

We will use Namespaces to host each environment application .

Beyond namespaces , how can we ensure network segmentation between various envrionments ( ie between dev & qas etc ) ?

Is network policy the only option ?

Is using MULTUS CNI a feasible use case for such east west traffic segmentation ?

Appreciate your quick response in this regard