vlan config, do I have this right?

I'm trying to isolate a network appliance so only one other device (my workstation) on the network can access it.

- I have a simple 8 port switch. Ports 1-8 are all on VLAN 1
- my networking appliance is on port 2
- my workstation is on port 3
- I created a VLAN with ID of 99 for ports 2 and 3, both ports are untagged
- I created a PVID of 99 for port 2
- Port 1 is connected to a route which provides Internet access

I think this configuration will isolate port 2 (the appliance) so only port 3 (my workstation) can access it while still allowing my workstation internet access. Am I correct?

If I have this setup right, is it working because port 3 (my workstation) traffic is transmitting and receiving on both VLAN 1 and VLAN 99 simultaneously whereas port 2 only transmits/receives VLAN 99 traffic, no VLAN 1 traffic? Do I understand that correctly?