[c-nsp] Best way to filter local traffic from Internet traffic

[root net]

Hello,

I have a customer that wants a 100/1000 Mb/s pipe into our network for our
local customers.  This customer is also a customer but he has a dedicated 10
Mb/s circuit to the Internet and is maxing out on bandwidth.  Wishes to buy
the 100/1000 Mb/s pipe for our local network access only not Internet.  What
is the best way to filter this?

This customer is on a dot1q sub-interface.

-rootnet08