Thank you. I paused for a little while as I was waiting for the second SSD and have just mapped out what I want this to look like, after some further reading and further confusion

but I think I'm okay now.
I was most likely getting confused as I was reading so many different people's methods - some using multiple hardware NICs (for the firewall's WAN/LAN interfaces, but as you said I won't need this), and then a mixture of the VLAN approaches, and then either pfSense or OPNsense, there was a lot to process at once
. I think I have settled on the "traditional" VLAN approach mentioned on the Proxmox wiki. I can try it out now, anyway.