how do Securely separate a department in an organization?

I need to create a subnet on a network for a different department that has security concerns.I want dhcp and AD to be on the main network but files services and internet should remain on the main network.should I create a vlan on the switch or get a router and put them on a different network?

thanks in advance