Wow pricey solutions me I'd take a junk PC Pentium 2 and throw in 3 network cards, load up monowall, https://m0n0.ch/wall/ and create 1 - Wan and 2 - Lan interfaces and cable each Lan to separate switches. create routing tables to allow bow Lan's to access the Wan but not the other Lan.