TLDR; VLANs reduce unneeded local broadcast traffic and can also reduce the ACL control points if paired with a logical IP range partitioning, besides reducing the network vulnerabilities exposure. Using one or another could be convenient, but combining them will give more benefits overall.
Giving my two cents about some of the reasoning behind layer 2 VLANs and Layer 4 IP partitioning, IMHO:
As VLANs separate the ethernet broadcast domains, they also reduce the overall traffic of administrative packets, like automatic searches for printers, directory shares or video devices, ARP/DHCP queries, etc. It is more efficient/fast a LAN with 50-250 hosts than one with 1000. If we separate floors one VLAN each or by department, the number of machines contending for local traffic not leaving the VLAN will be smaller. Besides that, we do not need the Human Resources printer showing in the Marketing printer dialog if each have their own!
Use case: In my University we outgrow our first (and not so well done) design of the main campus' LAN, where all buildings of the campus shared a single planar domain, even if was divided with different and separate IP ranges for buildings, laboratories, teacher offices, administrative floors, etc., but growing from 200 to
1600+ hosts talking all the time, the overall performance were definitely not optimal, so we had to design and implement multiple VLANs to reduce the local traffic and to reduce the general attack surface exposed to bad agents.
We found that the easier way to give/control net services to each VLAN were asigning each its own IP range, so it was simpler to debug network issues of any pc only knowing its IP address (i.e. VLAN 84 for the eight Computer Science labs in the Building F used the range 192.168.84.0/24, further subdivided in /27 ranges of 30 hosts each for easy rights/bandwidth control independent for each lab, and detecting any misbehavior of single pcs.)
This also reduced the students capability of testing our security measures trying to impersonate MAC addresses of office pcs or servers from any lab, for example. I remember several ocassions were some bad configuration of a single pc in some networking lab swapping IPs of host/gateway disrupted all campus operation. This was mitigated a lot: Only the specific lab or VLAN is affected now. Same with the DHCP server practice labs of networking courses!
Could be simpler to manage a large IP range instead of a lot of smaller ones, but having as many IP ranges as VLANs, the intercommunication between VLANs have to be done by means of layer 3 routing, reducing the control points for ACL deploying to the routers.
Actually, I can confirm that there is no reason for lab #2 of building C to contact workshop #4's pcs in building E: The only traffic allowed out of the VLAN/Range should be to Internet or to some internal server/application. Of course, the IT group shall have access to all pcs for giving remote support, but that is not a problem to define in the interVLAN core routers.
Each case is different, so we have to analyze more than the number of hosts, departments and building layouts to approximate an escalable and efficient network for our users and services. We need to include network use and type of traffic, current network equipment available, budget projections, job/admin procedure manuals, net services/apps used/proposed, risk measurements/plan, IP addressing availability/restrictions, IPS/malware detecting systems, redundant internet links or high availability needs, even IT people level of expertise, and not less important: trying to anticipate future needs.
In summary, the isolating nature of the VLAN/IP addressing of hosts in very specific groups helps to circunscribe the failure points and the overall control of the network, and is increasingly easier to manage with the modern SDN design/administer/programmability approach. Each mechanism is applied in different scopes of the network, but working with the two together will have the greater impact and contribute to better performance/security.
Also read: VRFs, VLANs and subnets: difference.