In the switch create 3 VLANs:
The first one, let's call it VLAN A for all the devices in range
The second one VLAN B for the devices in
And a third one for example VLAN C for the router.
Keep in mind that you must change the IP address of the router to make it belong to another subnet:
It means also that the router will be unable to act as DHCP server and the devices on the other two VLANs must get their IP addresses from other DHCP server on their respective VLANs or be configured manually.
In the switch there is a feature called static routing that you can use to create routes between VLANs.
Create an static route from VLAN A to VLAN B.
Another static route from VLAN B to VLAN C.
In that way VLAN A can communicate to VLAN B, but will be unable to reach VLAN C.