Usually, the best practices would dictate that a guest account would be placed in a secure network, isolated from the production network by firewall barriers. If it is impractical, then specific areas of access should be determined and they should be as restrictive as possible.
