So, the way you would do this is creating separate VLANs, then using firewall rules to filter what communication is allowed between them.

In my home for example, I use a few smart devices that are controlled over the LAN from your phone. Think like a chrome cast. I would rather those devices be on my IoT network than my main, but they break if devices from my primary network can’t find them.

So I allow only those specific devices to communicate across my VLANs, with other devices (cameras, lights, etc) being dropped at the firewall.

That’s the basics and can be accomplished with any semi-decent router/firewall. If you have any more specific questions regarding what hardware you have available shoot me a message and we can talk through it