@JulienF I will still work to add a potential for “securing” the aspects that can be secured.
As far as your NFS route, you only have a single subnet to worry about. You could create a secondary “subnet” for FOG imaging if you needed, or just restrict NFS to use that single Subnet (making it no longer publicly (globally) accessible).