Start from reading this.
If you want to isolate some computers from the rest of the network, putting them to their dedicated VLAN is a good first step. You can also configure the switch in such a way that these computers would not be able to communicate directly to each other.
But to make them access the internet, they also have to be in their own IP subnet, and something must provide routing between this subnet and the internet. Since you say the ISP router doesn’t support VLANs, it probably also doesn’t support multiple LAN side subnets. So the routing will have to be done on your CRS. And you may even have to configure NAT there unless the ISP router supports LAN side routes.
Since CRS326 is a switch, not a router, its CPU may or may not be sufficient to handle the traffic, depending on the uplink bandwidth and the amount of tasks you will ask it to do, such as traffic prioritisation. So once you try, you may find out you need a router too. What is your uplink/downlink contract?