Stanislav,
What is the end goal your looking for?
I see your configurations but I am uncertain as to what your looking to do. If you just want people to not communicate with each other, you can create vlans and do access rules denying the traffic between the vlans or there is an option called protected ports, and with this you could leave them all in 1 vlan. Then the devices you want to be isolated from each other make them in protected port mode. You can find this under the port settings. This isolates devices that are in protected port mode from anyone else in protected port mode. They will still be able to access devices that are not in protected port mode with this setting.
Here is a better description of the protected port mode:
Protected Port — Select to make this a protected port, which entails the following:
The Protected Ports feature provides Layer 2 isolation between interfaces (Ethernet ports and Link Aggregation Groups (LAGs)) that share the same Broadcast domain (VLAN) with other interfaces.
Devices from protected ports are not allowed to communicate with each other even when they are in the same VLAN.
Packets received on a protected port are dropped when trying to egress on any protected ports. Protected port filtering rules are also relevant to packets that are forwarded by software, such as snooping applications.
Port protection is not subject to VLAN membership. For example, two protected ports placed in the same VLAN are not able to communicate with each other. Port protection enables you to define ports that are able to send packets only to unprotected ports who will usually be the uplinks and not to the other protected ports. Ports or LAGs can be defined as protected or unprotected.
