Are there switches with the ability to isolate individual ports from each other?

Question

network hardware

Hello.
It is required to connect 9 clients to the switch, but 7 of them must not connect to each other. The other two have the ability to connect to anyone.
Because switches work at the channel (2) level, then nothing is known about ip addresses. Therefore, isolation must be at the port level. Like this:
Port 1, 2, 3, 4, 5, 6, 7 has access to ports 8 and 9.
Port 1, 2, 3, 4, 5, 6, 7 do not have access to each other.
Port 8 and 9 are unlimited and can connect anywhere.

In fact, this is the functionality of the firewall in the router, but I decided to ask if there is such a thing in the switches.
Or is it still easier to take a router?

Answer 1

Yes. This feature is called vlan.
Must be present on all managed switches.
But how exactly to implement it - I will not prompt.

Answer 2

Put ports 1-7 each in their own separate VLAN and make these ports untagged (access).
Make ports 8-9 tagged (trunk).
Then traffic from 1-7 will come separately to 8-9, but they will not be able to communicate with each other. Again, provided that on devices plugged into 8-9 there will be no routing between VLANs (of which at least 7 pieces will come to these devices)

Answer 3

Cisco switches have such functionality called Private Vlan.

Answer 4

And D-Link has it. It's called traffic segmentation .

Answer 5

it's easier to take Mikrotik ... and get cheaper and full functionality.
but in fact, a VLAN or a managed switch is enough, but I don’t think it will come out cheaper