network security -- how to isolate a single machine from external exposure

Here's the goal: my Windows network is exposed to the xfinity router for gateway purposes.  I apologize if my terminology is [Edited: "Language"] up.  I want to put one machine on there to be kind of a file server -- like a NAS.  But it will be soon to be unsupported Windows 10.  As such, I want to completely block access from the internet, but not inhibit any of the other devices.

Looking at the xFinity instructions for firewalling, I think I see how to block the entire network, but not just a single system.

Any redirection of my thought process or advice towards a solution would be greatly appreciated.

TIA

mardukes