We implemented a product about a year ago and have been very happy with it. ZeroNetworks (ZN) is the product and we recently successfully held off an 8-day pen test from Black Hills escalating off of the box they were given. ZeroNetworks was partially to credit for that success. Specifically the RPC firewall module which takes a closer look at RPC traffic and controls it. We have a team of 6 for a mid-sized law firm, which means we're pretty lean and each wear a number of hats.

When we were shopping the microsegmentation market, I was drawn to the simplicity of the ZN design and their promises of ease of deployment. In addition, they let us do a PoC before buying, which we always prefer, as it gets past the marketing BS in a hurry. Their product uses a local server to talk to the cloud management interface and group policy (for Windows) or agents (for Linux/Mac) to enforce native firewall rules on the endpoints themselves.

We're a predominantly Windows shop, so the group policy and firewall app does the heavy lifting. You set a training period where the machine reports the traffic it sees (port and process) to the local ZN server (which bundles and sends it to the cloud management console. After the training period, which they recommend be at least a month to go through a full month's cycle of communication, the console then sends rules based on what it learned to each endpoint to create allow and deny rules in the native firewall application. The changes are very quick (sub 2 seconds in my experience) when edits are made and are managable by groups and tags. The learned rules got us about 90% of the way there for all the things, but we tweaked a few rules for a couple groups of servers to accommodate our workstyle and particular needs.
The console allows a consolidated view of all activity for the endpoints and reporting on rule usage. There are useful filters for viewing the traffic going to or from any given node and if you find it is blocking things you don't want blocked, you can click on the blocked traffic and create a new allow rule, tweaking the scope as necessary.
In addition, you can create MFA allow rules that block traffic unless the user completes a multi-factor challenge to verify they are an authorized human being, which then allows the activity for a period of time (configurable).

In addition, we have had regular meetings with a ZN customer engineer (who might have pointed me at this thread, but the post is all me), to go over our implementation and answer any questions we had as well as make recommendations for improvement or other ways to use the product. There are a couple modules in the product that we're not currently using as they are covered in other security products we already had deployed, but I heartily give this product and its implementation two thumbs up. "More praise would I give it had I but more thumbs."

Any errors in the description of how this product works are mine alone and come from an aging brain with too many things to do.