I run a number of Shelly devices on an iOT vlan with opnsense, but I used the integration- could that be an option?
I found a couple of the shelly devices (the humidity & temperature sensor and the smoke alarm) needed to be able to access HA to send updates so I created an opnsense alias to allow them just to access the ip it’s on. I could see MQTT being useful for these maybe?
I also have a couple of plugs and plus 1pm’s that just sit isolated on the vlan and get accessed by HA from the LAN. The integration was super easy to setup for these.



Looks like one of the qotom/topton boxes you can find on aliexpress.
Can also pick them up with preinstalled *sense from Protectli (which I did I regretted nothing, totally great experience.)