Disable all local ports but not Tailscale

Hi there, I am quite new to tailscale.
I have it installed on my home server and I mainly use it to access my server from outside my home.
I was wondering if it was possible to configure my firewall on my server (or maybe is better on my router) to block all ports (except for ssh and the ones for tailscale) from the physical LAN (like from a device with 192.168.1.xxx), but allow all ports from the virtual LAN created by tailscale, maybe allowing only connection from 127.0.0.1 (which is how tailscale app might redirect the traffic it receives, I guess).
I want to do this to harden my security, because I have several "smart" accessories around the house and I don't fully trust them. I don't have a router that can create a separate virtual LAN, so this is the only solution that came to my mind.
Thank you very much!