Your company maintains separate Virtual Private Cloud (VPC) networks for the Sales and Finance departments within a single region. The Sales VPC network is already connected to on-premises locations via HA VPN, with non-overlapping subnet ranges confirmed. You aim to peer both VPC networks to leverage the same HA tunnels for on-premises connectivity while facilitating internet access for Google Cloud workloads through Cloud NAT. However, you must ensure that internet access from on-premises locations does not traverse Google Cloud. Furthermore, all routes between the Finance department and on-premises locations need to be propagated. What steps should you take?