Yeah, I'm thinking along similar lines. I'm not all that heavily VLAN'd, but I have my devices grouped into IP address ranges with static DHCP assignments, and I'm thinking of restricting internet access for a number of those groupings.
Not op but I have an opensense box and a semi managed switch and an couple of TP-Link omada controlled ap's for wifi.
It can make management a bit difficult if you're not careful, but I have wireguard listening on all the vlans so I can bypass any restrictions on any connection it can get my laptop onto if needed.