hi,
you need to config some vlans on the 3500 and put the uplink ports as untagged to those vlans. then enable ip routing on the 3500 and give the 3500 an ip-address in each vlan. this is also the default gateway for the clients attached to the vlans. then, to prevent the communication as you described you need to use ACLs.
example:
vlan 1
name "network A"
ip address 192.168.1.1/24 <- gateway for clients in network a
untagged 1,2 <- the ports belonging to this vlan.
exit
vlan 2
name "network B"
ip address 192.168.100.1/24 <- gateway for clients in network b
untagged blabla
exit
....
ip routing
ip route 0.0.0.0 0.0.0.0 <IP of="" you="" gateway="">
this is the basic config. now you need to look at acls, cos now everybody con talk with everybody.
hope this helps
ben</IP>