First of all, it would be better if you clearly stated which product do you use - "Windows Server 2012 R2" (which is not free product) with Hyper-V role installed or "Hyper-V Server 2012 R2" (which is free).
But anyway, what your configuration seems to lack, is the concept of so-called "management network". Because you have not stated this explicitly, I suppose that the administrator's workstation is placed in the same network segment as the users' machines. In that case, it wouldn't make much sense to 'separate' the host from the rest of the community. If you want to isolate them properly, you need in the first place to separate the administrator's workstation(s) into a dedicated IP subnet, then create one more subnet for the Hyper-V host, then another one for your virtualized server(s); if the Exchange is accessible from the Internet - yet another subnet for it (DMZ actually), and finally, a distinct subnet for the users. Then configure access lists - or, better, a firewall - on your network equipment. Obviously, you need a L3 switch/router/firewall to do all this.
As you can see, the small scale of your setup does not free you from complying with basic security principles. So if you still eventually run into troubles (chances are) this will be because of not adhering to the best security practices, and not because of configuring some feature one or another way.