A VLAN is by default a layer 2 broadcast domain. You can think of it as a room with locked doors, the people inside the room are only able to talk to one another. As soon as a device on the network has routing enabled, and assigns an IP address to the VLANs, it is like unlocking the doors. People inside the room can still talk to each other, but if they need to talk to someone in another room they can.  An ACL is like having a bouncer at the door controlling who can go through the doors. I think you will find that most all common practices suggest having a firewall on the network. Even for a DMZ you will see most deployments with a firewall before and after the DMZ. Or at least one firewall controlling traffic between the DMZ and LAN.   
hi, I'm reading docs searching for bits that talk of private vlans and I'd have a question, to be sure. What is the shortest path to make two ports(same vlan memebers and the only members of the vlan) forward only to each other but NOT to any other ports / vlans? b.w. L. 
PC62xx - private vlans / protected ports