L2 port security

If I understand correctly I think the best way to accomplish what you want is to use forwarding virtual servers with gateway pools that point to your firewall for policy enforcement. I've used this design with success in the past. Note that this is L3 and up. If you're binding multiple vlans to your port you won't get crosstalk across vlans with this design, so vlan hopping will be avoided.

 

 

Also, I'd avoid vlan groups, as a matter of preference.

 

 

-Matt