So this is where I should be bumped over to newbie. This is not a dedicated SQL server and hosts web sites as well. Can I assume there in no way to isolate the instance if it's server is also hosting web traffic?

If an SQL Server is supporting a web site but on a different physical machine, does that necessarily mean it's exposed to the internet? (note again this is not my case.)