Isolate a subnet on the same vcn

Summary

I need to isolate the communication between the subnets of the same VCN

Content

Hi,

In my cloud a vcn was defined and within this subnets are created for dev, qa and prod. Due to security requirements, we need the services between the subnets not to be visible, i.e. the production ips should not be reached from the qa and dev subnets.
Not visible I mean that they cannot be reached in any way, that is, you cannot do an ssh from  qa to prod environment, or from dev to prod.
my question is if there is any way to cover this requirement since using Security List and Network Security Groups do not cover this requirement.