How can I use wifi only for handoff?

Ok OSX wizards...

I have a dilemma. In order to use handoff/continuity at work I need to connect my Mac and iPad/iPhone to the same wifi network. Moreover, I also need to be connected to the separate office ethernet LAN to get my job done.

We keep the networks separate for security purposes. I don't want to make my mac the way the wifi network can be used to gain access to the internal ethernet network.

It works when I'm connected to both. But all my Mac's remote services are exposed on the wifi network. No good docs on advanced firewall config. I have no idea how the built-in firewalling interacts with PF. Do I even want to go digging in the depths of PF? Can this be done securely without massive headache? Is there a better way?