Hey RIM, pssst! There is nothing wrong with having the boring, but secure, reliable but quick, phone that just works. NOTHING.
You are being distracted into oblivion by people who WONT BUY YOUR TABLET ANYWAY.
That way, nothing gets in OR out that is not expressly permitted, or tied to a specific user account. An internal effected machine cant send anything out the gateway if its not via 8080 with the firewall client, and with a rule naming its executable.
If in any problem you find yourself doing an immense amount of work, the answer can be obtained by simple inspection.