I think I figured it out.

Using VLAN probably is the best way to do it.
Only thing is that the firewall makes it confusing with the 4090 and 4091.