Is there any easy-to-manage way to firewall off individual Ethernet ports from each other on a wired network switch in a large organization, so that devices cannot see each other or anything else on the LAN, unless specifically authorized in a firewall configuration for each port?

A typical application would be in a semi-public space where people may be bringing in personal devices that could potentially be plugged into the wired building network, to limit device discovery and nmap address probing.

I'm thinking that it is probably possible to implement manually but it would require some ridiculously complex configuration, such as assigning each individual Ethernet jack on the switches to a separate VLAN, and then in a router create separate firewall rule groups for each VLAN interface.

Using VLANs for this would only work up to the maximum 4096 VLANs. If an organization has more wired wall ports than that, then apparently the network would require physical cabling isolation and individual router NICs/cabling, to allow reuse of VLAN IDs on each router NIC.

Or perhaps use distributed routers in network closets to handle the physically segmented VLAN re-use groups, rather than having a single huge router in the main datacenter.

Is there any switch equipment which already provides this sort of individually firewalled ethernet port isolation?

Is there any easy-to-manage way to firewall off individual Ethernet ports from each other on a wired network switch in a large organization, so that devices cannot see each other or anything else on the LAN, unless specifically authorized in a firewall configuration for each port?

A typical application would be in a semi-public space where people may be bringing in personal devices which could potentially be plugged into the wired building network, to limit device discovery and nmap address probing.

I'm thinking that it is probably possible to implement manually, but it would require some ridiculously complex configuration, such as assigning each individual Ethernet jack on the switches to a separate VLAN, and then in a router create separate firewall rule groups for each VLAN interface.

Using VLANs for this would only work up to the maximum 4096 VLANs. If an organization has more wired wall ports than that, then apparently the network would require physical cabling isolation and individual router NICs/cabling, to allow reuse of VLAN IDs on each router NIC.

Or perhaps use distributed routers in network closets to handle the physically segmented VLAN re-use groups, rather than having a single huge router in the main datacenter.

Is there any switch equipment which already provides this sort of individually firewalled ethernet port isolation?