I’m not op, but It’s probably an isolated network with only one computer that has access to both the isolated network the th general network.

The restricted network (with the production or sensitive servers) has no direct Internet access and often no direct route from a corporate LAN.

There’s one “jump host” or “bastion” system that does have connectivity to that restricted segment.

Administrators connect to that jump host (often over RDP, sometimes SSH or a virtual desktop) from the normal network.

Once on the jump host, they can manage the internal systems inside the isolated network.