How can I use wifi only for handoff?

Ok OSX wizards...

I have a dilemma. In order to use handoff/continuity at work I need to connect my Mac and iPad/iPhone to the same wifi network. Moreover, I also need to be connected to the separate office ethernet LAN to get my job done.

We keep the networks separate for security purposes. I don't want to make my mac the way the wifi network can be used to gain access to the internal ethernet network.

It works when I'm connected to both. But all my Mac's remote services are exposed on the wifi network. No good docs on advanced firewall config. I have no idea how the built-in firewalling interacts with PF. Do I even want to go digging in the depths of PF? Can this be done securely without massive headache? Is there a better way?

This is quite easy.

Open wireless networking and remove the password for any/all networks you don't want to join and then toggle the Wi-Fi off and wait a dozen seconds or so before turning it on again.

The Wireless radio will be on and ready for handoff or AirDrop but not joined to any network/SSID. The computer will work fine with wired ethernet and a Wi-Fi radio on but not associated with any network that's in range.