Probably the easiest method would be to use a “Public Link/Private Link” configuration similar to clustered servers. The public link would be the connection to your Windows domain, and the private link would connect to the NAS. The trick in this situation is to configure the private link with a completely dissimilar IP address from the subnet used in you Windows domain. For example if your Windows network runs on the 10.0.0.0 subnet, you might use the 192.168.0.0 subnet for the private link. You also want to use the bare minimum amount of information when configuring the connection. You should only need the IP address and the subnet mask.
Two other methods you could use are:
- Implement an IPSec policy.
- Add persistent routes to the windows routing table.
With either of these methods you would be specifying that any traffic bound for the 10.0.0.0 subnet must use 10.x.x.x (insert actual IP address of public link here), and any traffic bound for the 192.168.0.0 subnet must use 192.168.x.x (insert actual IP address of private link here). All of these methods can be used together if you want to ensure additional safeguards to prevent cross-contamination.