Secure Option 1 - Network Isolation
Isolating the Card Key system and all the PC's that would access it is an option, but not overly practical for anyone but large organizations with dedicated IT network staff. But here is what to do if this is a viable option for your organization.
Step One - Assess the signature of your Card Key System(s) NMap or any other port mapping utility is your friend here. Throw scans at all of your Card Key systems and understand the ports they are using. Ports 80, 443, 9999, 100001, etc. These are the ports used by the Windows fat client application to communicate with your Card Key interface. Lantronics systems have an obvious signature once you discover them, record what you have for future reference.
Step Two - Who needs access to add users and from where?
If you have any chance to limit access to the Card Key system over the network, you will need to know what users, specifically their systems IP address, which will need to be a static IP in order to build ACL rules to limit what systems might be able to try and gain access to administer the Card Key system. If you can manage to limit who's computer needs to access your Card Key systems and in what locations, you might have a chance to build some network ACL's to restrict the Card Key system IP's to just those IP's of the workstations with the fat client. This is how you would secure the Card Key systems from a network access control perspective. Though if a malwarian pops one of these approved systems and finds the software... Game over.
Keep in mind if I can find your Card Key system on your network, it IS game over or more appropriately Doors Open, and all of them, not just one.
Secure Option 2 - Consider a replacement or upgrade
Once we reported the flaw to the vendor we tested they graciously provided an updated system after they addressed a couple of the issues they were able to, but Lantronics did not change a thing. This means the best way to improve this vulnerability is replace all your Card Key systems. I know this is a bad option since roughly 10,000+ Lantronics controllers are shipped each month... Yup.... Major bummer for users of this legacy design.
Secure Option 3 - Isolate the Card Key system to a single PC ( My highest recommendation)
Ironically the reason that the Lantronics Serial to Ethernet daughter board was created was to move away from the limitation of one PC serially connected to the Card Key device so any user on the network could manage user access in any location or worse... Over the Internet in the clear.. Yup, you heard me... Clear text auth!
This option would still allow you some flexibility in that you could locate the dedicated PC in any server room or closet with your other phone gear and use patch cables to connect directly to the PC via a hub or cross over cable. Using a 2nd Network card you could then connect the PC to the open network. If I were to scan your network for the Lantronics signature, I would not find any, just the Windows PC it was connected to and no way to know if it had a Card Key system attached. This security option allows you to remote into the PC using basic Windows remote utilities, RDP, VNC, or whatever you fancy for remote control and from anywhere on the network and yes, if you use a secure remote control option, even over the Internet.
So there you have it, the basic ways to secure the Card Key systems controlling your door access. Check out what JGor (@Indiecom) has done with some nifty Card cloning P0wnage. You might want to understand how this works as well, but is a different problem and affects a specific users card and the access of that card, unlike opening all the doors of a building.