During an active ransomware incident, an analyst confirms that a file server in the finance VLAN is encrypting shares and attempting SMB connections to hosts in other VLANs. Management insists the finance department must retain read-only access to already-encrypted backups on a separate storage appliance while the response team works. The team wants to stop lateral spread without fully powering down the affected server (to preserve volatile evidence). Which containment action BEST meets these constraints?