Single control-plane with multiple ingress gateways

I need to expose services outside Kubernetes. Some publicly to the internet, and some only within our network. Using traditional ingress, this is easy, simply deploy a second ingress class with different loadbalancer annotations

Reading the Istio documentation, it’s unclear how to do this. We’re testing with Istio Operator and the CRD. Can I deploy a second object with everything but a second ingress gateway disabled? Will it connect to Pilot et. al. in the other control plane?