Network isolation setup

[Payerl]

So I'm trying to isolate some of the hosts on my LAN at home for security.

My Current hardware setup looks like this:


What I want is that some hosts should only be able to connect to one specific server on the LAN but that server should be able to communicate with ALL devices on the LAN.
Also the hosts should not be accessable from other PC:s on the LAN (I differentiate hosts and PC:s here for clairity even though I know a PC tecnically is a host...)
I have tried to explain it with an image:


From what I rememmber of the networking class I did at the university I could have set up vlans for this (at least if it had been all wired connections) but is that the way in OPNsense also?

[hbc]

Use different ssids and assign each its own vlan.