firewall internal devices from rest of network

How can I firewall certain devices from the rest of my internal network?

For example I have two switches connected to the router. I want any devices connected to switch 1 to be able to talk to my entire network. I want any devices connected to switch 2 to only have internet access and no local access what so ever.

What is the best way to do this?