Your situation is no different than what every telco switching station must solve. First some basic concepts. Your NIC already has significant protection typically rated about 2000 volts. It is damaged because a transient current is incoming (ie via a buried wire) and outgoing via some other path (ie AC electric). Obviously it must be a serious current to increase voltages well above 2000 volts.
Furthermore, a protector that tries to stop or absorb that current is bogus. Voltage increases as necessary to blow through. No protector has numbers sufficient to absorb a destructive surge.
Second, the solution. Never try to stop or absorb that current. Connect that current to what it wants. On a path that does not pass through and stays away from the NIC. Telcos do this by routing wires underground before entering the facility. By earthing each wire in every cable. By making that connection to earth as low impedance (ie short) as possible. No protector does protection. Earth ground does the protection.
Some protection systems have no protector. A wire (no protector) makes that connection to earth. Every protection has and carefully installs the only item that does all protection. The item that absorbs hundreds of thousands of joules - single point earth ground.
Best protection is also distant from electronics. Telcos want up to 50 meter separation. But your location sounds like that is impossible. Therefore an earth ground must be even better. For example, surrounding the building with a buried loop would help. Any wire (AC electric, ethernet) that enters must connect at a common point. A low impedance connection to earth means no sharp wire bends, no splices, is not inside metallic conduit, and routes separated from any non-grounding wires.
How many AC electric wires enter? Three? A neutral wire might already be earthed. Other AC wires must connect to the same earthing electrode just as short. But make that connection via a 'whole house' protector.
Same rule applies to each ethernet wire. Each cable has eight wires. Each must also connect to that same earthing electrode; make the same low impedance connection. Obviously, ethernet cannot connect directly. That is what a typically green wire from the ethernet protector does. Connect each wire to earth via a protector.
The resulting surge could be incomcing on ethernet and outgoing via AC electric. Or incoming via AC electric. Choosing a best ethernet wire that connects to earthborne charges miles away. Either way, damage means an incoming current path and a completely different outgoing current path exists. Makes no difference if wire is overhead or underground. It must make that low impedance connection to single point earth ground where entering NIC building. Otherwise current will find other paths to earth destructively via NICs.
Appreciate how major that current must be with each storm to cause damage. Approaching 2000 volts for no damage; or greater than 2000 volts to have damage. Serious transient problems even when damage does not occur. IOW no protection other than what is already inside electronics. Does the Furse ESP 06D have a dedicated ground wire? If that wire is connected to a wall receptacle safety ground, then not earthed. Receptacle safety ground is electrically different from earth ground. The Furse must connect low impedance (ie 'less than 10 feet', no sharp bends, not inside metallic conduit) to single point 'earth' ground. Only then does it become part of a protection system.
Third, every layer of protection is only defined by the earth ground. Above defines the 'secondary' protection layer. Also inspect a 'primary' protection layer. A picture demonstrates what must be inspected:
Fourth, some facilities use metallic conduit on buried incoming wires to increase protection. Buried conduit is typically up to 50 feet long. And all conduit join together at the single point ground before wires enter.
Fifth, above only defines protection for the building. Treat each gate as a separate structure. Therefore each gate also has its own single point ground. Any wire that enters a gate controller must also be earthed to that gate's earth ground. The rule is this simple. Any incoming wire (single or power) must first connect to earth before entering. Either by a direct connection or via a protector. Only then will a surge not connect to distant earthborne charges destructively through electronics.