It depends on how they work. IIRC the Hue bridge connection can be statically configured with an IP, and then some firewall rules should be enough ( authorise your main network to talk to the Hue IP).
That still doesn't fix the fact that it relies on network broadcasts for many core functionality (app discovery of the hub, etc). Putting your IoT devices on their own VLAN sounds like a good idea, but they usually aren't designed to work in that sort of situation and you're likely to create a bunch of usability and management problems that won't be solved with firewall rules.