If you are worried about the security of the brand name WiFi router, i would just try to set up pfsense on a stick(need only one NIC). I am pretty sure i have seen an official guide for that.
So basically, you plug your switch (access port) to the isp router, and plug the pfsense box into another port(trunk port) on your switch. Define a vlan for internet, and have that access port tagged with the same vlan. Then turn off routing in your brand name router and use it as a pure access point. Now you can play with vlans as much as you want
I wouldn’t worry about the isp router, it has no access to your network, and most traffic going through it should be encrypted anyway. And for your brand named access points, you can block them from accessing internet.
Edit: The guide: Official documentation for “router on a stick”
I have a 7 year old LG Smart TV(webos), on a vlan without internet access. Using the built in integration "LG WebOS TV” for automations. I used to use WOL for turning the TV on, but nowadays it seems like my shield works fine to turn it on over CEC.