Standalone Cert authority in a 2008 R2 domain

I have a 2008 R2 domain with a root certificate authority, there is a group policy that auto enrols certs to all servers and client PC's.

We are going to be using Dynamic VPN through a Juniper SRX110 cluster,  we require a certificate authority which is separate from our domain and won't dish out certs to internal clients and servers.  The Juniper Engineer said to install the CA on one of our domain controllers.

How do I go about this?  I did a test install and it handed out some certs to our internal domain.

Thanks

Ross