Yeah, I'm thinking along similar lines. I'm not all that heavily VLAN'd, but I have my devices grouped into IP address ranges with static DHCP assignments, and I'm thinking of restricting internet access for a number of those groupings.

I redid my home network this year largely to be able to get off of cloud-based cameras and properly VLAN untrusted devices.

What are you using for this in the home?

Not op but I have an opensense box and a semi managed switch and an couple of TP-Link omada controlled ap's for wifi.

It can make management a bit difficult if you're not careful, but I have wireguard listening on all the vlans so I can bypass any restrictions on any connection it can get my laptop onto if needed.

much like the other commenter, opnsense router, a couple of managed switches Ubiquity Wireless AP.