Any way to have a private network inside a single SSID?

Maybe there’s a industry feature/implementation for this but i’m unaware of what it would be called

Essentially is there a way to have a single Wifi SSID yet have private networks inside of it so that i.e. we have devices A/B/C/D/E connected to it
A and B are guests, on their own, client isolation, they can’t see or talk to each other
C/D/E are treated like their own little LAN, can broadcast to each other and exchange Layer2 information as normal, but have no interaction with A/B

The first question is where does this need to be done. Can it be done at the switch level, or does it need to be done at the AP?
The second is can this be integrated with hotspot?

The end goal is to have all devices that use the same voucher code be on their own network so they can chromecast or do whatever, but also to have client security so there’s no device-to-device communication from those with different voucher codes
This needs to be an automatic process, not manually managed

I know this can be done with multiple SSID’s but i’d rather avoid broadcasting dozens of them if possible and just have a single one with everything managed through a voucher/username system

Just thinking here, haven’t touched hotspot since 2015, also tired at the moment, but maybe use hotspot with radius eap authentication, assign them in relevant vlans dynamically

You can also use /capsman access-list (if you use CAPsMAN) or /interface wireless access-list rules to assign a dedicated VLAN ID to devices, as well as to override the client-to-client forwarding setting, based on MAC address of the client device. So whereas client to client forwarding will be disabled for regular users, you can permit it for these specific ones.