Yes, think of a vlan99 as the trusted subnet.
(1) In a business, that VLAN should only be accessible to the Admins. All attached smart devices should get their IPs from this vlan.
(2) In a home, the home LAN could be the trusted subnet, or it could be a subnet that the admin is on all the time (convenience). If you wanted to get really sticky with best practices, still have a vlan 99 and a managed switch at your desk and every time you want to config the router or any smart device on the network plug your ethernet cable into a different switch port to access vlan99.
The trusted subnet should be an interface list entry with appropriate interface list member(s).
Its should the only interface that can have one interface member (as interface list power is being able to combine interfaces for rules etc.).
The IP TOOLS MAC WINMAC server should also be set to this interface.
The IP neighbours discovery should be also set to this interface.
As for Vlan, correct there is no need for VLANS if the number of subnets does not exceed the number of ports, if it does, then vlans make sense. As you have noted, the other common case is if you need to send multiple subnets down a port, typically to another smart device that can read vlan tags.
+++++++++++++++++++++++++++++++++++++++++++++++++++++
If your concerned about proper vlan config and security then carry this through to the input chain rules which is access to the router. Most default configs have some variation of
add chain=input action=accept in-interface-list=LAN
This does allow all users access to commonly required services such as DNS, or even NTP, however it also allows all users (including guests) to possibly access the router.
Better is:
add chain=input action=accept in-interface-list=Manage (or BASE etc…)
add chain=input action=accept in-interface-list=LAN dst-port=53 protocol=tcp
add chain=input action=accept in-interface-list=LAN dst-port=53 protocol=udp
add chain=input action=drop comment=“drop all else”
Even better is:
add chain=input action=accept in-interface-list=Manage src-address-list=authorized { narrow it further by IP addresses }
add chain=input action=accept in-interface-list=LAN dst-port=53 protocol=tcp
add chain=input action=accept in-interface-list=LAN dst-port=53 protocol=udp
add action=reject chain=input in-interface-list=LAN reject-with=icmp-admin-prohibited {useful for tracking/troubleshooting LAN issues}
add action=drop chain=input comment=“drop all else”