Have you looked into Tailscale or an equivalent solution like Netbird?

You could set up a tailnet, make create unique tags for each machine, add both machines to the tailnet, and then set up each machine’s network interface to only go through the tailnet.

Then you just use Tailscale’s ACLs with the tags to isolate those machines, making sure they can only talk to whatever central device(s) or services you want them to, but also stopping them from talking to or even seeing each other.