Isolate IOT LAN PORT

We don't have IPTV, just basic cable and internet. Xfinity box is connected via wifi. We could use coax, but wifi works fine.

We don't need a lot of bandwidth. We do fine with 150 Mbps or less. I can't see paying for speeds we don't need. $130 a month is already too much

I currently have two routers with "double NAT " with the financial computer behind the second one, but because the family wireless is on the first router with everything, including the solar inverter goes through that, creating security concerns.

 I want all the IoT devices ( Solar Panel inverter, TV box, Roku) on it's own isolated network for security reasons. I can find nothing out about the security of the inverter company and the only way to monitor it is to hook it up to the internet.

Inverter requires an Ethernet connection.

So I think what I need to do is use the IoT VLAN 30 for those devices and assign the Router LAN  port 3 or 4 to IoT and also change the port mode to Access

Hard wire the Satellite to Router ( in basement)  through LAN port 1

Use Satellite  LAN 2 for financial computer in loft with separate Wifi ( which I have now)

Use "employee" VLAN for family stuff 

If I need an LAN in loft here will assign the Satellite LAN 3 to Family

Am I correct in assuming that the LAN ports on Router and Satellite are totally separate and LAN port 3 can be assigned to IoT on Router but to "Family " on Satellite?

Continue client  and network isolation for IoT but disable client isolation for Family.

Am I also correct that Administrator network can access all other networks even if on isolation?

Will use mDNS to share printer on Family LAN Satellite port

Use