NetBIOS security problem over dialup.

When running a PC on a LAN with a dialout internet connection, we want to allow netbios over the LAN but not on the dialup. However, if you edit the properties for the TCP/IP protocol bound to the dial-up adapter and uncheck the netBIOS box, this also disables netBIOS on the LAN! Is there a way to make windows close down ports 138 & 139 on the dial-up without adding more protocols or 3rd party software? To amke things harder, this problem only appears on some PCs…