Assuming the private LAN is secure (big assumption I know but lets go with that for a while) then your biggest threat here is presumably the Intranet "front end". No matter what you do it will always have to be visible to the people you presumably consider to be a threat, and as it needs legitimate access to the database it will always be a conduit for malicious access too.
I realise you know this already but if I was attacking your system to steal the data on that DB then all I need to do to bypass your protection is to breach the Intranet system and sit there making apparently legitimate requests that all your security will happily allow through. So you need to make sure you balance time spent hardening both servers.
So yes, you can consider a physically isolated network between the two machines - If this is literally just a 2 machine network between the DB and the front end then I don't see the point of adding a hardware firewall into this mix at this point when the software one is adequate, once you combine it with all the "obvious" usual stuff like locking down/switching off unused services, using security templates to create a secure, well locked down baseline, etc.
I'd definitely consider something like IPSEC to further protect this link against physical attacks (e.g. someone just plugging a packet sniffer into the switch and having a good old "listen"), and I'd probably have logs from both machines copied to a syslog server somewhere so I could review suspicious events between the two machines in a coordinated manner - you can add in automated monitoring and alerts from this point too of course. Depending on budget and need I might add an IDS such as tripwire into the mix too.
But like I say, assuming reasonable physical security of the servers themselves then your biggest threat is likely to be compromise of the Intranet-facing box itself, at which point a smart intruder will just manipulate this box to grab data via requests that appear legit, so you need to spend at least as much effort and thought on securing this side of things too.