I am doing exactly what you are trying to do (as shown in the last diagram you shared) with a Netgear R7000, three vlans, trusted devices, guests, IoT.
This r7000 is running tomato kille72 v2017.2.
It just works for me and I just spent about $90 for the router.
Sent from my iPhone using...