remove the default gateway for the secondary card, and then you have elimintaed the access to anything beyone local. If you need a remote address on that card, then use the route add command to add it.
route add X.X.X.X Mask X.X.X.X GW.IP.Here.X metric X
I have a setup where I VNC in on one connection and perform network testing on the other connection. I had to ensure that the VNC traffic was not going to the testing connection, and had to set it up with some care.