A hospital runs a legacy application on an unsupported operating system that can no longer receive security patches. Management refuses to decommission the system because it is critical to patient scheduling. To reduce risk, the security team isolates the server on a dedicated VLAN and places a next-generation firewall in front of it to inspect all traffic. Which type of security control BEST describes this approach?