Redesign home LAN for IoT

I am looking to redesign my current network for my home to accommodate these new IoT devices and want to maintain a secure way in isolating that traffic from my private LAN. Some of the IoT devices will have ethernet plugged in while others will use WiFi. My private LAN consists of a NAS (RN104) and a dedicated Windows 10 Plex Media Server.  I currently have one set of IP cameras on the Guest Wifi to keep that traffic separate but thinking ahead if I decide to connect a home automation HUB to my network.

My current network consists of a Netgear R7000 with 2 WiFi networks one for private and one for guest/IoT wireless devices. That hardware is on the second floor of my home. I ran one network drop from the upstairs media room to downstais office where there is a Netgear GS105A gigabit switch that connects the upstairs to down. On the downstairs switch, I have one hard wired PC with a Ethernet to USB print server and a Raspberry Pi3. From that downstairs switch, there is another cable run that goes to the living room where there is another GS105A switch that has an Arlo base station and a Roku 4 plugged into it. 

What i would like to do is to separate the Arlo Camera base station and the Rokus's (that are hardwired) on a separate VLAN network while using just the one network drop from upstairs. In the upstairs, I thought about taking the NightHawk router as the VLAN private network and aquire another cheaper router or wireless AP to use for the IoT VLAN network.  

I am looking at purchasing an Ubiquiti EdgeRouter Lite 3 Port router to create the 2 new VLANS. 

Then purchasing a GS108E smart switch for the upstairs to have both VLANS connected and connect each Wireless AP to their respected port. My question is, is it possible on the GS108E switch to configure one port with both VLAN ID's and have that port connect to the network drop leading downstairs. If that is possible, then I would believe I could just connect a GS105E switch and from that switch. plug the print server and desktop PC to the private VLAN and the network run to the living room to the IoT VLAN and still utiilize the existing 5 port GS105A switch there so that both those devices are on the IoT VLAN and not on my private network?

Am I on the right track with this or is something like this possible? I really do not want to go the route of the "3 dumb routers" option becuase then my Plex Media server will not be accessible to the Internet for me to stream from remote locations due to Double NAT limitation.