Every device that forwards traffic between IP networks is a router, so since you ask about routing functions of 1950 I explain you IP basics using appropriate term and call 1950 a 'router'. Sorry for the confusion. Since 1950 routes between VLANs, it is obvioulsy a router from this perspective. Layer 3 switch is more a marketing term, it describes a device that has many ports, understands VLANs, can route between IPv4 networks, may support some dynamic routing protocol etc. In modern networks the boundary between an L3 switch and a router is somewhat fuzzy. But let's put philosophical disputes aside (-:
The thing is you can't really enable inter-VLAN routing for a part of your VLANs, but keep it for the rest. Actually there is such possibility, but for that you need to delete Vlan-interface, the SVI of respective VLAN that needs to be 'isolated'. But then hosts inside that VLAN won't be able to communicate to the outside world, as they will loose the default gateway. Of course you can say "what if I just pass the traffic of such VLAN over a tagged port to my Drytek router and it will play the role of default gateway?" Sure, but in that case again you will need some kind of a firewall, this time in the Drytek router to tell it what and where can go and what is not allowed.
So, to be honest the only choice to achieve what you want is the following scheme:
1. 1950 has inter-vlan routing enabled and it cannot be disabled. Keep in mind that routing happens only between VLANs which have Vlan-interface (SVI) with IP subnet assigned.
2. Configure VLANs needed (done)
3. Configure respective Vlan-interfaces (done)
4. On the 1950 set the default static route (0.0.0.0/0) with the next-hop IP address of the Drytek in the same subnet (done)
5. Set the reverse route/-s for 1950's subnets in the Drytek router. Next-hop is 1950's address in the same VLAN (done)
6. Enable NAT for the 1950's subnets (not sure if Drytek needs it, some routers, especially small-business or home ones just NAT everything by default)
7. Allow hosts in 1950's VLANs communication with Internet, but at the same time deny them from talking to their 'neighbors' in other local VLANs. (to be done)
Point #7 is the most interesting part. If you want to block local VLANs from talking to other VLANs, then one general ACL will be enough:
rule 10 deny ip souce 192.168.0.0 0.0.255.255 destination 192.168.0.0 0.0.255.255
rule 20 permit ip
This ACL denies all traffic from the hosts in the 192.168.0.0 - 192.168.255.255 range destined to 192.168.0.0 - 192.168.255.255 range (effectively ALL traffic between hots in your VLANs) and allows everything else, like access to the Internet. You need to apply this ACL in the INBOUND direction on all Vlan-interfaces of the 1950.
If you need more granular permissions, just put something else instead this 'rule 10', but keep in mind one simple, but very important rule - more specific rules should be on the top of the ACL, more general ones should reside at its bottom. And another rule - there is an 'implicit deny' at the end of each ACL, so be sure to have at least one 'permit' statement in your ACL.
I know it may look strange to you, but in fact that's how all routers (and L3 switches) work - routing is routing, and traffic filtering is traffic filtering. Two different features, even really unrelated. That's why routing tables in general have all known networks inside (or routes how to reach them), but Vlan-interfaces than engage firewalling feature (like ACLs) to set proper permissions for traffic forwarding.