

FWIW, I use the VLAN approach. I have a VLAN (101) specifically for IoT shit. The firewall allows devices on other VLANs - general purpose (104), infrastructure (102) and servers (103) to connect in to 101, but nothing can reach out. Works seamlessly. The only issue you might bump into is that some devices use UPnP/mDNS for discovery, but OpenWRT has a proxy module you can install to facilitate that.
You may be wondering why the tags I use for my VLANs are so odd. I also wonder that sometimes.


Different subnets, similar to how you describe. It would be really tricky to have them on the same subnet, especially if you want a firewall between them.