I have a client that has a couple of machines that are build to cut kitchen tables. These machines still run on Windows XP and are connected to the internet.

Now I need to find a way that these people can run these machines as safely as possible without updating from OS (not possible, I asked the manufacturer from the machines). 

The problem is that these machines need to be connected to the internet so that the manufacturer can push updates to them.

What is a best practice to keep these machines working and connected to the internet as safe as possible?