I mocked up a diagram in Visio as it can explain the network topology better than I can:
VLAN 1 is a standard VLAN
Basically the top switches contain hosts on VLAN 1 and a trunk to the router on a stick. The bottom switches contain hosts in VLAN 1 and VLAN 10 (the private VLAN, which VLAN 11 is the isolated VLAN).
Since the trunks for all switches must pass VLAN 1 and 10 (or 11?) traffic I did not make them members of a private VLAN. Also since the router on a stick is trunked for both vlan 1 and 10 (or is it supposed to bee 11) I did not assign it as a promiscious member of any private vlan.
The desired result is:
1) Hosts in VLAN 1 can communicate with the router on a stick (which also has the default route to the internet not shown)
2) Hosts in the isolated VLAN are able to communicate with the router on a stick in order to communicate with the server on VLAN 1 as well as the internet