Router for setting separate VLAN for IoT devices

[cysio528]

Hello everyone,

Background: I currently have Asus RT-AX68U router and I would like to set separate VLAN for my IoT devices.

In theory I guess I could set up Guest Network just for that, however I would also like to have Home Assistant server set up in that network. I would like to be able to disable Internet connection for those IoT devices and keep it local, only exposing it via Home Assistant. Home Assistant server should be accessible from my "main" network. Ideally I should be able to remotely enable/disable Internet connection for those devices / network through Home Assistant or some other means.

And there's my question - what would be the best way to my desired result?

1. Getting new router with VLAN support to handle it all (VLAN, firewall for specific VLAN).
2. Getting other, not that advanced router, just for the IoT network and set up some firewall to block internet connection?
3. Or maybe some other approach? Would configuring firewall even be the right approach here?

Thanks for all suggestions