One Exchange Forest, multiple customers - stop mailflow for some?

Hi

I strange question follows :-)

I have a customer who host mail for several customers.

Recently it has been nessesary to block ALL internet traffic. 

One of the customers are VIP and now they want a sollution that secures mailflow for the VIP even if we lock down the others.

I say, that can not be done. Same Exchange Forest, same send connector, same DNS. I suggest a new forest with a new seperate Exchange installation and then create linked mailboxes.

Any suggestions? Or did I forget something? :-)

Thanks

BR
Steen