I work as a consultant in LAN, WLAN and security.
Mostly this question arrises when in need for a routing point for new VLAN/subnet.
My preference is definitely the firewall (if you know enough how to manage your firewall of course.
This adds security and reliability in a simple way
- a router forwards by default, a firewall blocks by default. This means that only necessary services will be permitted.
- router is not session aware, a firewall is session aware. This makes configuration of ACL a lot less burdensome.
- a firewall has easy logging about what he blocks, an ACL on the router mostly only gives counters. This enhances troubleshooting and visibility into your network.
The pay-off of course is that a firewall has for the this same reasons worse performance per dollar than a router or L3-routing switch.
For sure you should isolate all traffic that normally does not has heavy traffic outside its VLAN: guest internet, infrastructure from 3rd parties (HVAC, access control), DMZ, APs, VoIP, ...
Question is the traffic between standard client PCs and servers. If you run it throught a firewall, throughput should be considered. As well keep in mind that a firewall without IDP does allow or block certain services and does not look what happens inside this specific service.
So here we have to balance security vs. investment.
Right now, Juniper is launching a new series of firewalls with incredible performance, for reasonable price, which makes it possible to replace your routing core with a routing firewall. Have a look at the SRX series. This SRX firewall with Gb throughput does not cost more than routing switch of decent brand.