Can you setup a BM server with three NICs so that NAT is enabled on
one, but
not on the other?

The goal is to have one main site with two remote sites. One of those
needs to login to NDS through BM (and therefore NAT must be disabled),
other site needs to have NAT enabled but does not need to login. (The
remote sites should not see each other.)

Is this possible with three NICs? And also, if we do this, will we be
to filter both directions at a port level as well as an IP address
with both the NAT site and the non-NAT site?