Prior work in HOSTEDCP-645 was not able to block traffic using NetworkPolicy.  The requirement we have is simply:

• it is not possible for traffic originating from one Hosted Cluster to access another Hosted Cluster unless a network path exists that is not managed by Red Hat (i.e. public internet or customer private network).