I need to isolate one computer in a small office from the office network - from both NetBIOS networking with other machines and at the IP level. The office is just one of a number of businesses in one building - each office has its own network & internet connection hardware connected to a patchbay in a cupboard - I've already tried some measures to physically isolate the machine in question with some wiring changes, but as soon as the device is plugged into the patchbay, the router that provides the office internet connection appears to connect the whole lot anyway (basic NetGear ADSL router).
We have a Netgear Smartswitch on which I've set up a VLAN to encompass all the machines I do want networked and another VLAN that only includes this one machine and the internet port. I can still ping the other office machines from the `isolated` PC and vice versa even though it can't be accessed via NetBIOS. Is a VLAN strictly a Layer 2 thing, or would a Layer 3 managed switch incorporate VLANs that operate at the IP level too? We have some security requirements to fulfil for a planned project, and until there is money available I can't simply move the isolated PC to its own dedicated internet connection (which is the ideal). I know I could use a firewall and block internal private addresses but if the project takes off, a hardware device that deals with unwanted traffic before it can get to the PC in the first place would be the best option.The PC in question will be used for remote-assistance, accessing other computers over the internet. Any suggestions and insight welcome.

you can modify the protocol bindings so that certain protocols only work on certain interfaces.

I dit it once (a long time ago) with a windows NT server. Back then , i used IPX for the internal (netware) network card and TCPIP for the internet-facing card, meaning it was more secure as there could be no passthrough at all.

Thanks for the reply - I've already removed the Windows Networking Client and File & Printer Sharing from the PC in question, disabled NetBIOS over TCP/IP - it doesn't need any connection at all to the internal network. I'll probably end up insisting on a separate router and put the machine in its own subnet, no need for expensive equipment that way....

a second router is the way to go of course
and it's not expensive at all