What you want is a managed router. These let you do things like deploy custom configurations and create sub + virtual networks. You don't want an airgap, but you want to separate less trusted/more exposed devices to not be able to see all the other devices on your network - primarily if it gets compromised. Put those devices on their own virtual network.