You can set your mask and gateway up in your DHCP scope to whatever you want, even if it's a non-routable network. At least, I can do it with NetID and Infoblox. I haven't tried with Microsoft.
Then, on your 8600's, configure the network without OSPF, disable local redistribution, and disable ASBR.
Or, you could leave the router at one IP address (say .15) and deliver a Gateway address of .1 via DHCP.
Unless the users/devices knew about the .15, they would be unable to route.
That should do it.
TankII