FFH4500 wrote

Group A is on the primary network. Group B will be on their own private network via the Wireless Access Point. 

Which VLANs do you use? Is your »primary network« on the pfsense tagged with VLAN ID 1? If so, don't use it, choose another VLAN ID. pfsense has some, ehm, »interesting« VLAN concept with its vnics and vswitch.

What's more, if you run pfsense in a virtual environment you might need to use VLAN 4095 to have pfsense keep 802.1q tags set by the pfsense virtual machine on a portgroup.

I suggest to not use the router's and switch's Default VLAN 1 at all, but use two VLAN IDs > 1 and < 4095. You can find many posts on the Internet about the correct setup of pfsense as a VLAN-aware router depending of the platform/environment it runs on.

FFH4500 wrote

 

So I have the VLAN working but in this configuration, the VLAN (Group B) can still access all the data and resources from the primary network (Group A).

Then you have either Group B ports in both, Group B and A VLAN or the pfsense does LAN-to-LAN routing between the two VLANs B and A. Or you did assign IPs from Group B and A networks to VIFs in the switch which implicitly turns on Inter-VLAN routing (unless IPv4 routing has been turned off globally).

I can't control this at the PFsence router because the switch is prior to it. So all traffic on port 8, VLAN 20 needs to be blocked from access VLAN 1 but still access the PFsense router for internet.

Of course you can control this in the router's firewall. LAN-to-LAN resp. Inter-VLAN routing must be disabled. If the VLANs are terminated in the router, Internet access (LAN-to-WAN) still works for both networks A and B if it is enabled in the firewall. The routing path for both Groups is controlled by setting the default gateway for clients via DHCP to either Group B's or Group A's IP address of the router.

See this post (scroll down to method 2) for a setup of a Private (Group A) and a Guest (Group B) network. If you can translate OpenWrt syntax to pfsense syntax/settings, it shows how to set up two truly isolated LANs on the router, the switch and even the AP (yes, I did understand already that you don't need both VLANs on the wireless router).