I have configured my switch conform example 1 in the support article https://www.tp-link.com/nl/support/faq/788/.

The article says : "It is required that the computers in the two groups cannot communicate with each other, but both of them can access the internet via the router."

This is my requirement too but:

If a user with a PC in Group A in VLAN2 add a static route to his PC he can communicate with computers in Group B in VLAN3 via the router.

What must be done to make the statement true in the article that the two groups cannot communicate with each other??