There is no way to tell SharePoint to put a WFE on only one server in the farm. However, even if it did, merely putting one WFE on one server only provides the illusion of isolation as the service accounts used on both boxes would have the same network permissions and both would have the ability to utterly corrupt their underlying content databases (at least!) should they be compromised.
If you need true isolation, then you will need to create a separate farm with separate service accounts and isolate that farm between two firewalls (this is a best practice anyway) One Firewall is between the Extranet farm and the internet and the other is between the farm and the Intranet. It is also recommended that all machines that run in the area between the two firewalls be in their own domain and that this domain not have a two-way trust with the Intranet domain.
However, business demands sometimes require that actions be taken that are less than ideal. As such, the "lite" version is to make sure that the service account that is used for the Application Pool used by the Extranet Site have the least permissions possible on the internal network, the farm servers themselves and on the underlying database server. Under no conditions should this account be in any Administrators group anywhere nor should it be used for any other application pool other than the one for the extranet. This provides at least a basic protection layer but - again - this is not recommended as it isn't truly secure and would not pass even a cursory security audit.
Next is to configure your external DNS so that the extranet site url goes directly to the server that you want to exposed to the internet. Also, make sure the the Intranet site URL is not visible in any way on your external DNS. Your internal DNS can be configured however you wish but for simplicity it would make sense to map each URL to the server desired rather than to a load balanced URL.
This whole topic can get a great deal more complicated and Microsoft has some documentation to explain the official options that are available here and here.