Useful firewall config info here for preventing SMB traffic from leaving the network.

https://support.microsoft.com/en-us/help/3185535/preventing-smb-traffic-from-lateral-connections