When architecting networks and discussing trust boundaries, there are a few things to keep in mind:
- Physical segregation
- Logical segregation
If at all possible, you should start with physical segregation. This means the test network is not connected to the same switches and other network gear that production is. This may not always be possible. For example, if this is a lab environment where people can walk in to a room and interact with this test network, great. Or, if there is a VPN that can be placed in front of the segment to allow centralized interaction, that's another option.
However, there must also be logical segregation. This means network routing (including VLANs) must not allow connectivity between each network. Crossing these boundaries is something I use in pentests. It's usually easier to break in to a dev or QA environment and then pivot up than it is to break in to a production environment.
So, it is going to depend on a few factors that really only you can answer:
- Business needs
- Ability to orchestrate network segregation (including network fabric configurations)
- What kind of risk you are willing to assume given the above two
There is far more to properly architecting a network than I can write here, and much of it will depend on information I don't know, or want to know. This will include the current architecture of the network, services running, and what those business needs are.