Block network access from terminal

Hey everyone!

Need help. I have a terminal server in AD. The terminal server is public with few remote apps for 5 accountants. Installed Remote Apps connect to another server with MySQL databases in my local network and he is not public. I want to block network access from the public terminal to the local network with the exception of the SQL server. That 5 accountants should not have access to my network at all. Via GPO I blocked cmd, powershell, and iexplorer. In RemoteApp settings, I left only the clipboard and printer mapping. Any advice for resolving my idea?

Thanks for help