You can physically isolate by running multiple independent switches, you could run different subnets on the same switches or you could VLAN separate but that would require a managed switch or setting up your topology that something tags the traffic with the proper vid before running on the unmanaged switches. All have their pros and cons but i would strongly recommend getting a managed switch (managed firewalls/routers/switches depending on features/port count can all fill that need) and doing VLAN separation if you don’t have a lot of equipment you’re starting out with.