Maybe ASUS BRT-AC828 can fit your requirement, which model equipped with 2GbE WAN, and come with OpenVPN/IPSecVPN, VLAN, USB NAS and internal RADUIS server.
https://www.asus.com/Business-Networking/BRT-AC828/
As my experience with the device, the WPS can only allow my repeater to connect with. I don't know why WPS button can reset the router, that's pretty impressive result.
by the way, my firmware version have been updated to 3.0.0.4.380.7288 for a while.