Whenever you open up a port for inbound traffic, you are adding some risk to the network. Note that you said "insecure" but the truth is that you need to think about levels of risk. There is no such thing as a "Secure" computer, especially one connected to the Internet. You simply need to make breaking into it too hard to be bothered with. You should also try to limit the damage someone can do if they do break in which is really what you are asking when you talk about "isolation".
The risk is obviously greatly multiplied if you allow an attacker to gain a foothold on any computer, even an SBA. This is particularly true of a home network where you typically have no segmentation of the LAN. So you should and MUST care about the SBA in that situation. Thankfully, most SBA's run pretty standard Linux installations and so can be configured with the same level of security as something like a VPS.
Can you do anything?
Maybe. It rather depends on what equipment you have available or what you are prepared to install and configure. An increasing number of home/small-office routers are capable of creating a DMZ which isolates one or more machines on their own network segment. Alternatively, you can create a really strong DMZ by chaining 2 routers with your inner router carrying your WiFi and other computers and the external one connected not only to the inner router but also to your semi-protected SBA.
Also make sure that any user accounts on the Pi have no relation to user accounts on any other device and that the Pi does not need to connect to anything on your inner network. If you need comms to the Pi - which surely you will - they should be "pushed" to the Pi and not from the Pi to another device.