I can help you with a deployment of OpenWRT as an unprivileged LXC container, vlans/firewalls configs.
UCG is kind of self explanatory, a physical switch has to be adjusted for the vlan/port.
Unfortunately can't help you with Sophos, never used it. OpenWRT does everything I need and more.
I like...