Good luck with that, on many devices the BMC gets silently bridged onto the lan ports even if you make a significant effort to prevent it.
Even where you think you have it isolated and have tested, you may later find yourself thwarted when an unoverridable bridge gets triggered any time the dedicated BMC port's link is down.
I don't think that's true.
I can't speak for all devices, but I've worked with a lot of Dell and SuperMicro servers and they all have an option in the BIOS for this. You specify if the BMC should operate on it's own dedicated network port or share the network port used for primary network uplink.
From the network traffic logs I've gathered, I've never seen any indication of the BMC interfering with the primary LAN ports when the BMC is set to use the dedicated LAN port. Additionally, the BMC doesn't revert back to the shared port if the link is broken on the dedicated port -- the BIOS setting prevents that.
At my company we've configured all of the BMCs to use the dedicated LAN port, those LAN ports are connected to physically separate top of cabinet switches, and those switches are linked to a fully independent core router with it's own independent uplink to the internet. The BMCs are only assigned private network IPs and can only be accessed by outside users through a VPN. This is all very standard practice for the hosting industry.
They do, but on the three supermicro board types I have here, simply doing that but then leaving the BMC port disconnected results in them bridging onto the lan anyways. They obey the setting but only so long as a link is up on the BMC port.
I'm responsible for netsec at my company and I've never seen any indication of the BMC network activity on primary network ports after I've configured the BMC in BIOS to use it's dedicated network port.