A separate VLAN created for the printer(say PVLAN). All PCs are in default VLAN.

A router (R1) is connected to both default VLAN and PVLAN. A static route is configured in R1 for the printers IP Address (IP1) via PVLAN interface. Appropriate firewall rules configured in R1 to forward packets only from defined/allowed source IPs to the printer.

Printer is assigned an static IP (IP1) from same pool as the PCs and default route is R1.

DHCP is configured to push a static route to client PCs which are allowed. The static route defined R1 for IPs assigned to printers.

Now any access to the printer is goes through the router/firewall, where you can configured which system you want to allow printer access.

PC <->DefaultVLAN<-> Router<->PRN VLAN<->Printer