If separation is all you’re after, any managed switch will work. Even a “smart managed” one. But you’ll need Wi-Fi access points that can actually have SSIDs assigned to VLans, like the TP-Link, Mikrotik or ubiquity (basically anything aimed at business). At least if some or many of the iot devices are Wi-Fi based.