RAXE500 - Can I use VLAN tagging to isolate one physical port?

I am using an RAXE500 as the centerpiece of a home network.  Is it possible to configure this router (VLAN?) to isolate one of the physical Ethernet ports from the rest of the network but allow it to continue to connect out to the internet?

My wife has a home office and wants to connect an unmanaged switch to the (home) network.  I would like to give her a connection that is isolated from all WiFi traffic as well as traffic on the other wired Ethernet ports but still allow her access out through the Multi-Gig port to the cable modem.

Please/thank you for any input.