It basically depends on whether you want to rely on mdns, like printing from your phone.

The standard lock down by making a vlan and subnet and then adding filtering works fine if you can reach the printer reliably by IPP or jetdirect.

Once you need to connect two disparate broadcast domains, things get weird. It was the same story for Chromecast devices for me, their functionality and convenience are based on a relatively flat network and a single broadcast domain.