A VLAN is a separate logical layer 2 network without physically separate infrastructure.
Understanding this and your requirements, it is obviously faster and simpler to use an ACL.
Despite this, if for some reason you wanted to create a VLAN anyway, bearing in mind that each VLAN represents a separate broadcast domain and separate logical layer 2 network, you could simply not route the subnet the non-Internet-connected VLAN is on to the Internet. You must route between your VLANs, however, if you want the devices on one VLAN to communicate with those on another (the typical way to do this is the router-on-a-stick configuration). This means that all your devices would use the inter-VLAN router as their default gateway, which would in turn be responsible for sending Internet traffic toward the Internet (or not, as the rule may dictate), and doing NAT if required. Depending on topology, your inter-VLAN router may or may not also be a border gateway.
You can freely switch access ports from one VLAN to another. Ensure you are serving DHCP to each VLAN, and that you either request a new IP (reboot the device or release and renew the lease as applicable) when the VLAN is switched (shutting down the port and stating it again will usually effect this, from the infrastructure side).