[Samba] Winbind set to only serve certain addresses?

[Sherwood Botsford]

After a bad week of internet worms, I want to setup my clients so 
they can't see eachother at all.  Clients talk to servers.  Full 
stop.

Now part of this is easy.  If I use the correct option in
my dhcpd.conf file I tell the clients to use WINS mode 2 (use a 
server) give them a server address, and it puts a stop to all 
that broadcasting.

What I would like to do next is to keep clients records from 
being visible to other clients.  Part of this is to turn off 
"File and printer sharing" on the clients.

What else do I need to do?  (Or is this one of those cans of 
worms that breaks too many thing.s)