Private VLANs to micro-segment user space

Hi everyone,

We are thinking of ways to segment our employee user space (data VLANs) to prevent spread of malware, specially ransomware, in layer 2 domains. I was thinking of using the concept of private VLANs to do that. Am I looking at this the right way? Does anyone have better suggestions on how to pull this off?

Thanks, JJ