First time rebuilding an office network “hands on” and how can I make sure our WiFi cannot talk to our server?

Thanks for your patience in advance!

This is my first time reconnecting a small office network using a new ISP-provided router. The server (file storage, AD) used to reside on a 192.168.5.X subnet.

After the router was implemented, all the workstations received a dynamic IP via 192.168.1.X. But the server was still using its older static IP. To get the server talking, I changed the static IP to a new static IP with the same subnet as the workstations.

My question: when connecting to the secure WiFi, any device gets a dynamic IP and can talk to the server. I do not like this approach because I understand this is not a security best practice. How do I ensure any connections on the WiFi can only talk to the internet? It sounds like they both need to be on separate subnets but maybe I’m mistaken. If that is the case, what actually controls these subnets? Is it the router or do I need a separate type of device?

Thank you for helping a newbie.