This is far and away the most FAQ here, it's frustrating to see a question four times on the first page of a forum.
There's no strict "best practice" because there's several elements open to interpretation, however, the obvious answer would be:
One vSwitch with two pNics. Has a vmkernel for management and vmotion.
One vSswitch with the remaining pNics. Has a VM portgroup
If your switch won't do VLANs and you connect all four ports to the same switch - isolating is pretty much a thereotical exercise. Either upgrade the switch or accept that these things are not isolated.