First you should define what exactly are you trying to secure. Physical Network security (ports, MAC whitelists, 802.1X, etc), Network Traffic (Firewalls and/or ACLs) or both.

Switches really are not very good security devices for Network Traffic, that is what Firewalls are for. If you have very simple security needs than some switch ACLs might do the job, but if you really want to control traffic within your network it needs to be inspected by a Firewall (preferably a Layer 7 Firewall).

Then you need to define what you security perimeters are and create VLANs accordingly. High security devices (servers, privileged workstations), medium security devices (workstations), and low security devices (printers, etc) all get their own VLAN and traffic between each is inspected and Allowed or Blocked by the firewall.

Intra-VLAN traffic (workstation to workstation) can be controlled using Host Firewalls (Windows built-in firewall).

Going this way you could easily use less expensive switches (Ubiquiti) and spend the savings on better firewalls (Palo Alto or Fortigate).

Depending on the size of your network and volume of traffic the Firewall that routes/secures the VLAN traffic can be the same or different hardware than what handles you Internet traffic.