I like to have a private VLAN across two CRS354 switches.
I need to set forwarding-override to the uplink port.
But how do I achieve isolation between hosts on the two switches when the hosts on the other switch are connected via the uplink port?

I'm asking you to rephrase your question. In plain english words describe what is your goal and we'll try to design and implement the solution.