Private Vlans Secondary to Primary

I can’t seem to find this answer anywhere. I want to have the hosts in the secondary vlan in a community vlan so they can’t talk directly to other things in the same subnet at layer 2. I do want them to be able to talk to stuff in that subnet by hitting the router. A L2 firewall sits between the router and the switch. Hopefully that makes sense what I’m saying.