Depending on your current and expected (soon-ish) ISP speeds, consider that a new AX class router may probably be enough to cover the areas you need, and do it with more throughput, too. I would not recommend buying an AC class router today (and in my experience, you're correct that mixing AC and AX class equipment is detrimental to maximum performance and stability out of the newest routers).
This is what you may see in your environment, even if you (instead) bought another RT-AC86U today.
The AX router should give you greater throughput, better usable range, and a much more reliable network.
There are some odd regressions being discussed on the dnsmasq-discuss list from the PiHole guy (Dominik). https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2021q3/015598.html https://lists.thekelleys.org.uk/pipermail/dnsmasq-discuss/2021q3/015596.html I see Merlin is testing 2.86 out...
www.snbforums.com
And, don't forget that is an 'entry-level' AX class router too.
With your router very quickly getting closer to EOL today, consider a real upgrade in performance instead with an AX class router.
And, if you can use your old router for a wired-capable device in Media Bridge mode, that would be the best use for it today.
So if I'm getting you, You would put an ax as the main router and the ac (on the second floor) connected to it via ethernet (I have it in each room) in media bridge mode? but then will I have one wifi network or 2?
If you don't need 2x 2.5GbE ports RT-AX86U Pro is a better choice. More compact device, same hardware, same firmware features (Pro firmware still not released though, coming soon). Connect your RT-AC86U as wired AiMesh node and see how it goes. Give your client devices some time to realize another possible AP to connect to is available. AiMesh is more marketing than real "mesh". Wired access points or wireless repeaters with central UI basically and one shared Guest Network option (very often with issues). Works best with identical model routers, but still behind some other "mesh" products.
Something better will require complete system overhaul plus networking knowledge. Stick to the plan above as more cost effective and user friendly solution. If it doesn't work well - get 2x RT-AX86U Pro or 2x RT-AX88U Pro routers and try again. AiMesh works best wired and with identical routers. For VPN client on the router - they can do up to about 200Mbps on OpenVPN to common public VPN providers. WireGuard is also available and allows faster speeds, but it depends on what options your VPN provider offers.
Media Bridge mode connects to the main router via WiFi. Any wired-capable client devices you can connect via Ethernet to the Media Bridge router will benefit greatly.
The 'network' you will create will depend on the SSID you connect to (Main or Guest).