When you say public network do you mean that there are other machines on the same network as these 4 machines? For example 10.1.1.5/24 and 10.1.1.6/24 would be considered the same network as 10.1.1.1/24, 10.1.1.2/24, etc. If no, then just remove the default gateway/route from the workstations you want to isolate. If yes, then use some software firewall on each workstation to limit inbound and outbound traffic to whatever you want for however long you want.
"See packet, be packet, you are packet. Ignore all else!" -The Networkerpacketsdropped.wordpress.com