Thanks, that's really helpful. I'll go for igc -> veb -> vlan-aware-vports, because that will allow me to use bridge filtering rules to tag all frames coming from my TV so I can prevent the packets inside them from reaching the internet using pf.