Hi,
you can create a dedicated vswitch without uplinks. Elsewhere, you can override the uplink settings from a port-group. VMs added to portgroups without uplinks are isolated.
If you have a distributed vswitch, you can use private vlans as well.
Greetings
Falk