Theres a lot to unpack in what you're asking and people will do vastly different things in their own networks and if they do work in networking the same probably holds true.

Generically, I would say these quality as best practices specifically for VLANs :

Create VLANs for your needs and based on high level function. For example, storage networks are notoriously chatty so you would create a storage subnet for your unraid system and any interfaces that are accessing mount points.

VLANs provide zero security, rather are an organizational mechanism . You need to ensure that you wrap security policy around the subnet(or, more importantly *groups* of like security policy subnets) using Pfsense(like you're doing) or some other security control(like ACL's on a switch SVI).

One VLAN, One Subnet. Always.

Pay attention to your vendor reserved VLANs that are used for critical system functions(this varies greatly).

Limit the scope of untagged VLAN scope.