Can your firewall handle more than an "internal" and an "external" network? If it can handle three networks, you should define them as "LAN", "DMZ" and "Internet", and then connect those interfaces to different switches (or different VLANs on a managed switch).
If your firewall can't handle the DMZ, then you'll need to set up your network in a different way (and add another firewall); anyway, you'll end up with two logically-separated network segments, the LAN and the DMZ, which can communicate only through a firewall.
You should then choose if you want to separate your VMs only at the network level, or if you actually want DMZ VMs to run on different hosts than LAN VMs.
In the first case, each ESX host should have at least three network interfaces: one for the service console (connected to your LAN), one for connecting VMs to the LAN and one for connecting VMs to the DMZ; if you want VMotion, add another interface for that, too.
In the second case, each host needs at least two intefaces: one for the service console (always connected to the LAN, you don't want that in the DMZ) and one for VM traffic. Again, if you need VMotion, you'll need another interface.