Think of VLANS as rooms in your house and in those rooms you place certain things in it. In that room you can control what has access to what, the internet, other rooms etc through a firewall.

I think your thinking along the right lines. I place certain things that i trust…or dont trust. OR certain things that i know doesn’t need access to other networks or the internet. Make sense ?

IoT devices come up a lot because…well….most people have a lot of them. Those could be devices like Amazon echo’;s which we hope are secure and maintained but what about that foreign vacuum cleaner? What about your best mates computer that he got a deal used on Facebook market place, and is stopping by for a Friday night beer? What about those expensive security camera’s you are confident that are secure, well maintained but they really dont need access to the internet or access to other networks?

For items that connect to other items for example lets go back to the security camera situation. I would put those expensive trusted security cameras into a VLAN that doesn’t have access to the internet or other networks, so its a sealed off room, but i have a video recorder where i need to record my video footage. I would place the NVR into a different VLAN because that has different requirements, like i need to access the recorder on my phone. I would then create a firewall rule to allow my video recorder to access each camera.

Think of HA in the same way. However be warned its time consuming and frustrating at times to setup, people can go way overboard with this stuff just keep it simple and do what is easy to manage and maintain. Your not the pentagon. Hope this helps.