If you have a switch that supports it, 'protected ports' for cabled connections or 'client isolation' for access points on Wi-Fi can help you eliminate traffic between hosts in the same Layer-2 network.
For example, this is from Cisco switch manual:
Protected ports have these features: A protected port does not forward
any traffic (unicast, multicast, or broadcast) to any other port that
is also a protected port. Data traffic cannot be forwarded between
protected ports at Layer 2; only control traffic, such as PIM packets,
is forwarded because these packets are processed by the CPU and
forwarded in software. All data traffic passing between protected
ports must be forwarded through a Layer 3 device.
So if you don't intend to transfer data between them, you don't need to take action once they are 'protected'.
Forwarding behavior between a protected port and a nonprotected port
proceeds as usual.
Your clients can be protected, DHCP server, gateway, etc. can be on unprotected ports.
As @sirex pointed out, if you have more than one switches which are not stacked, meaning they are virtually NOT a single switch, protected ports won't stop traffic between those.
Note: Some switches (as specified in the Private VLAN Catalyst Switch
Support Matrix ) currently support only the PVLAN Edge feature. The
term "protected ports" also refers to this feature. PVLAN Edge ports
have a restriction that prevents communication with other protected
ports on the same switch. Protected ports on separate switches,
however, can communicate with each other.
If that is the case you would need Isolated Private VLAN ports:
In some situations, you need to prevent Layer 2 (L2) connectivity
between end devices on a switch without the placement of the devices
in different IP subnets. This setup prevents the waste of IP
addresses. Private VLANs (PVLANs) allow the isolation at Layer 2 of
devices in the same IP subnet. You can restrict some ports on the
switch to reach only specific ports that have a default gateway,
backup server, or Cisco LocalDirector attached.
If PVLAN is spanning over multiple switches, VLAN trunks between the switches should be standard VLAN ports.
You can extend PVLANs across switches with the use of trunks. Trunk
ports carry traffic from regular VLANs and also from primary,
isolated, and community VLANs. Cisco recommends the use of standard
trunk ports if both switches that undergo trunking support PVLANs.
If you are Cisco user, you can use this matrix to see whether your switches support the options you need.