Separated over the PCIe bus with an IOMMU between it and system memory, as well as hardware switches to disable it if I’m not reachable
I haven’t found a way to remove it entirely. It’s the only option I’ve found so far, but if you know of a better designed option, I’m certainly interested