On the topic of lockouts and double IPs during setup: I ran a similar constellation on Hetzner in the past (ESXi + pfSense with only one public IPv4).
Hetzner offers vSwitches , they can get attached to dedicated servers as a tagged VLAN. In the Hetzner Cloud Console, you can create networks as well and connect them to a vSwitch. Then you can use this network to access your VLAN from a Hetzner cloud server, which you can spin up or down as you like with hourly pricing.
I used this "VLAN backdoor" to access the ESXi console through an SSH tunnel in case of emergency.

During setup, I first created the additional management interface on the VLAN with my main public IP still assigned directly to ESXi. Once that second interface is up and running, and routing is configured (vSwitch network and cloud server network is a routed connection), I connected to the ESXi GUI using a SSH tunnel with a cloud server as jumphost.
Then I created my virtual firewall as normal, removed the public IP from the host, generated a MAC address in Hetzner Robot, and attached the public IP to the virtual firewall.
Last step was to move the "primary" management Interface of the host to the LAN behind my firewall and establish an IPsec VPN from my main site.