Worth noting even the cheapest router chipsets normally support vlan tagging, so with a sub $100 router you can flash an opensource firmware on it like openwrt and then isolate network traffic on each port and filter it with iptables.