The closest feature that comes most literally close to what you're looking for is Dynamic Access Control (DAC) in Windows Server 2012 and 2012 R2, but I don't think you're going to end up standing all the necessary infrastructure just for that. Even if you did stand up DAC you're relying on a lot of "moving parts" and you really should have a "belt ans suspenders" approach with layered defenses.
Setting DAC aside, I think you'd be best off starting by segmenting your network using layer 3-7 access control mechanisms (ACLs, firewall devices, etc) to put those servers that perform public-facing roles into portion of your network that has strict ingress and egress rules to prevent those servers, should they become compromised, from acting as gateways to attack the rest of the network. If this means that you have to split some roles off to new hosts then, so be it. I tend to be one of those people who thinks that you should have physical separation of security zones, inasmuch as is feasible. Separate switches, VM hosts, firewalls, IDS, etc, should be the ideal and you should work away from that only as feasibility dictates.
You're right to be concerned about this. A friend of mine related an external web application pentest that ended up turning into a successful compromise of the Active Directory on the LAN "behind the firewall" where the public web app was located. That kind of thing can and does happen.