2 Groups of users - different internet access?

[Matthew]

Hello everyone,

New office location, we have our executive team and our support team, marketing and so on,

Basically the exec will get full access, i dont want to use DMZ of course cause i want them to havbe the protection of the firewall.

Support anjd other departments will have highly limited access, using squid and such, most ports block, specific access to outside connections and so on.
What would be my best option to do this?

VLANs perhaps or?

since the Exec will need to share files with other departments as well for projects.