A retail company wants to design a VPC for their new e-commerce platform that separates the public-facing web servers from the internal payment processing system. What is the best practice for achieving this network segmentation?