The only real reason to prevent a network from being routable through a firewall is to make sure it's isolated both from external and internal unauthorized access. It's impossible for someone to hack into a system if there is no physical path for electrons to travel from their position to the target system's position. By unplugging any cables linking the target system(s) to the rest of the world this ensures there is no physical path.
This does however drastically reduce the network's functionality and ease of use since you'd need to be in a specific physical location to interact with any of the target machines. The more secure something is the harder it is to use and the less functionality it has.
If the testing environment doesn't need internet access then the best/easiest thing to do would be to just not connect it to the firewall at all. Just create a testing subnet, put all the servers in it and plug them all into a switch. All the servers will be able to talk to each other and since there is no physical connection to the firewall it's impossible for anyone that doesn't have physical access to the switch or servers to access them.
If the testing environment does need internet access then I would still create a network zone for them (same as above) but in the firewall I would ensure there is a deny rule for any traffic destined for the testing environment. Since any firewall I've seen manufactured in the past 5 years has statefull inspection turned on by default and most of them don't even have an option to disable it, this will allow the servers to reach out to the internet and traffic coming back on that same port will be allowed.
Depending on what exactly they mean by "safe and private" the second scenario is the most likely to be implemented in real practice since almost everything needs to reach the internet for remote management and patches. The first scenario though is the "safest and private-est".