Each VLAN has an ID number, and a managed switch tags traffic with that ID using the IEEE 802.1Q standard. Ports and Wi-Fi network names are assigned to a VLAN, so a device joins the right segment wherever it connects. Devices in one VLAN cannot talk to another directly; traffic between them must pass through a router or firewall, where rules decide what is allowed.
On a flat network, a guest's infected phone or a cheap smart device sits alongside the accounts PC and the file server. VLANs separate them without buying a second set of switches and cables. Typical small business segments are staff, guests, phones, printers, cameras, and payment terminals. Separation also makes it possible to limit guest bandwidth so it does not slow business systems.
VLANs only help if the rules between them are strict; allowing everything between segments undoes the benefit. They need managed switches and access points that support tagging, and a clear record of which ports and Wi-Fi names belong where. A mislabeled port can drop a device into the wrong segment. We design VLAN layouts and firewall rules as part of office and hospitality network setups.