Due to the basic design of Ethernet you can not protect clients in the same broadcast domain from spoofing each other. Even though the switch that they are connected to will learn MAC address to port mappings and try to only send traffic to the correct port, there are tricks that can be pulled to spoof another station's MAC address and get their traffic. Look up tools like Ettercap.
Therefore, you need to build your security model around segregating things that absolutely must not spoof each other into different VLANs. So for example you might put everything that only has admin access in one or more VLANs and put everything that has untrusted users into one or more other VLANs.
Inside each VLAN, traffic that absolutely must not be impersonated/sniffed by other stations in the same VLAN must use encryption at the transport layer.