You need to use private-vlans.
Private vlans are used in a case where devices on the same subnet and vlan need to be separated from one another. For example in a hotel floor you may have devices in each room in the same vlan but you don't want one guest to sniff other guest's traffic.
To acheive this you need private-vlans consisting of two communities.
Private-vlans is composed of primary and secondary members. Promiscuous will be member of primary vlan but isolated and community will be member of secondary.
Members of same community can talk to each other but not to different communities.
Members of isolated vlan cannot talk to other isolated vlans or communities.
But both community and isolated can talk to the promiscuous which is the port that is connected to the router.
You need to put pc2 & pc3 in one community and pc1 & 4 in another community. So each pair will be able to communicate between with one another but not with the other community members.
To visually illustrate it
2001 - community - pc1 & pc4 should be here.
2002 - community - pc2 & pc3 should be here.
Hope it made sense to you.
You can read more about private vlans here: https://www.cisco.com/c/en/us/td/docs/switches/datacenter/nexus5000/sw/configuration/guide/cli/CLIConfigurationGuide/PrivateVLANs.html#42874