Hi,
Thanks for the detailed description.
For your current setup, separating the two LAN ports into different VLAN/interfaces is a simple and straightforward way to achieve this.
You can refer to the following Brume 3 configuration example for the VLAN and firewall setup: