I did not read the entire post but would like to share my setup: All containers, KVMs, and PVEs are on a delicated VLAN.
To achieve that, I had to remove linux bridge and then install openvswitch on each PVE node.
Reconfigure PVE so that vmbr0 is a openswitch bridge and configured to use switch port of a physical NIC.
Next, on each virtual machine, create nic and set the vlan ID set to ie. 11.
It is just a slick setup because essentially you're utilizing 802.11q. Traffic from the dedicated vlan is completed isolated from your house network. Also make sure that you configure your router so that traffic from lan can be routed to vlan 11.
good luck