opnSense and use that immediately after your new ISP device

This. It’s how I set up my local network, tho I went with pFsense and then hung Pi-Hole+unbound off the managed switch. I did have to set up a vlan just for my lady friend because, apparently, screens full of ads is exactly what she likes, and I don’t want to have to reinvent the wheel every time she comes over. So, I guess you could say it’s pain avoidance. LOL