VLANs. You create an IoT VLAN, set it to be accessible the specific way you want, and you're done.

If you want to be extra secure you can fire up a Docker container that sits on this VLAN + your regular network, and proxies printer requests between the two, so you have perfect control over what happens and when.

Fair note, none of the apps (e.g. AirPrint) will work this way. They use Brother's cloud to connect to the printer.