internal only portGroup on vDS

Hello, is it possible to create on vDS (vSphere 5.0, Enterprise Plus)  PortGroup for internal VMs only. We need to setup two VMs: APPS and DB. APPS VM should have access to DMZ, internal campus network and DB server. DB VM should have access to APPS VM only (no Internet, no internal campus network). Would it be better to use standard vSwitch for this purpose? Will we be able to use vMotion between hosts?

Thank you for all advice and recommendations.