When I sketch out your desired network, there are really two obvious options, which depend on how isolated you want the "mini-server" to be from the laptops. There's the easy way:
which has the laptops and the server all linked together with no specific security between them, and a common point that provides connectivity to the Internet (the big, dark cloud looming at the horizon).
In this configuration, all the systems on the local network basically have to trust each other. You can run host-local firewalls (and I recommend that you do, regardless), but if someone is able to compromise the server, they will have largely unfettered access to your LAN. If the server uses a wireless connection, this may also include the ability to put its network card in promiscuous mode to monitor all wireless traffic that the server is able to hear. Depending on your threat model, that might not be good enough.
However, such a setup is doable with just about any home router that does NAT, basic firewalling and port forwarding. Almost any home router on the market will satisfy those criteria. If the ISP-supplied router/modem combination doesn't (it very well might), then get a personal NAT router and switch the ISP-provided one to "bridge" mode, then change all connections to go to the one you just bought instead.
However, there is another alternative, which depending on your needs may work better. Consider this setup instead:
This is slightly more complicated. The server now connects to the ISP-provided router/modem (possibly through a switch) in the same way as another router does. (The "server" here may be a separate router, which in turn connects to the server itself. That would put the firewall duties in a separate box, as opposed to on the server, but either approach can work.) This isolates the server from the laptops. There are a few ways of doing this, depending on whether your ISP is willing to assign you multiple IP addresses or not. If they are, then the easiest is probably to run one incoming cable (uplink) to the ISP-supplied router, then two cables from there (you might need a switch for this), one to the server and another to a simple router of your own. Put the laptops behind the router of your own. This way, traffic from the server will look like traffic from the Internet to the router protecting the laptops, while the laptops can communicate with each other and with the server (assuming you allow such traffic in whatever firewall is protecting the server), and the server can be exposed to the Internet without putting any of the other systems at risk. Physically, that will look similar to this:
The yellow zone router may or may not physically exist; especially if you don't need more than one host in that part of the network, it's perfectly plausible to run that as only a host firewall on the server. In this case, there are three zones: red/gray (untrusted), yellow (partially trusted) and green (fully trusted). Hosts within a zone can communicate relatively freely with each other, but it's easy to configure firewalls specifically to block traffic from less trusted to more trusted parts of the network. If you do this right, they will do so by default.
The upside of the latter approach compared to the simple one at the top of the answer is that it isolates the server. If someone manages to break into the server, they won't have easy access to the other hosts on your LAN, or any of the traffic between the laptops or between a laptop and the Internet. The yellow zone, here, is what is properly known as a network DMZ (demilitarized zone); note that this is substantially different from how many home NAT routers use the term.
For wired networks in particular, by now you can use differently colored cabling to clearly identify which parts of the physical network are trusted and which are not. For wireless, you can use different SSIDs, like HadidAli-Green and HadidAli-Yellow, with different keys; either also ensures that a system doesn't accidentally connect to a part of the network it doesn't belong to.
This isn't dependent on any particular products. You can use any products you like that implement the required functionality which, really, is pretty basic. Virtually any home NAT router will allow you to set up port forwarding, and will block unexpected traffic coming from its "WAN" (Internet) side going to the "LAN" side, while allowing traffic to flow in the opposite direction. About all you are really doing is repurposing the LAN and WAN ports ever so slightly. As long as you don't put one NAT router behind another NAT router, this should have no impact on how the network actually works; running NAT behind NAT is a rather different kettle of fish, and can easily turn a simple configuration into a nightmare.
I think that the only thing I think I'd add to this is to turn off any "ease of use" features such as Universal Plug and Play (UPnP) and WiFi Protected Setup (WPS). Unless you have a specific use case that requires them, in my opinion they have a tendency to open up more security holes than they are worth. Turning them off reduces your attack surface, which in turn makes any attacker's job more difficult.
