How to configure a server [having DNS and ADS roles installed user account created/configured] to restrict its shared folder access to a specific computer in the network.
Sol-1: Solution proposed here https://superuser.com/questions/629099/how-to-block-an-ip-address-from-a-network-share doesn't work as "Windows Security Model restricts access per-user, not per-IP"
Sol-2: Another solution proposed here: https://support.managed.com/kb/a482/block-an-ip-or-ip-range-using-windows-ip-security-policy.aspx is completely blocking the connecting computer/IP as a result, specific computer (nomiated to block shared folder access) is even unable to resolve ADS user's credential when tried to logon.
More Details
Goal
We want ADS users (around 30 in numbers) on a company network to browse internet without any restrictions, download whatever they want, but prohibit upload of company data to cloud.
Situation
To satisfy this need,
Hosted a domain server with ADS setup. Call it MAIN-SERVER.
None of the users' computers are connected to internet, but they are all LANed.
No user is allowed to share a folder from his/her computer on the LAN.
We placed another server (call it NET-MACHINE) that is connected to internet and it is also connected to MAIN-SERVER (it has 2 network cards). All users who wish to browse internet can connect to NET-MACHINE through Remote Desktop using their ADS credential.
Now, users sometimes want to download something and use it on "their" computer, so there is a shared folder on NET-MACHINE, that is read-write on NET-MACHINE machine but read-only when accessed as shared folder over network.
Challenge
Users sometimes want to share data with their colleagues. So, there is a shared folder on MAIN-SERVER that is read-write for all users on network. Now, here is the interesting thing, this shared folder on MAIN-SERVER is also accessible to NET-MACHINE which we want to restrict. When a user logs in to NET-MACHINE using RDP, they shouldn't be able to access the shared folder on MAIN-SERVER.
Request
I am novice to this computer networking stuff, so please feel free to comment if you see any other reliable approach to manage users to restrict upload but in the same time give them complete freedom to surf net.
How to restrict NET-MACHINE to access shared folder on MAIN-SERVER