If you have the hardware (switches) to separate out the networking infrastructure then I would do it for pure performance reasons.
We use a physical firewall to block anything and everything from entering our management and VMotion networks.
They are both vlans behind the firewall but we can still allow special access from the administrator's workstations or a management server to reduce the foot print. This method allows us to manage the network with special exceptions.
Its pure risk vs cost. If you think you have a high chance of someone Vlan hopping on your internal network then using physical security is the best bet. If it's low risk, then just segment it off with vlans and use access-lists and switch ports to reduce the chances of vlan hopping.
Hope this helps you decide.
