Why segment?
Separating automation devices from office clients reduces unnecessary access paths and narrows the troubleshooting scope. A VLAN does not provide security by itself; combine it with routing and firewall policy.
Build an access matrix
Document required flows first: management workstation to web interface, NetRelay to the local MQTT broker, and application-server access to the HTTP API where needed. Deny by default and allow only justified traffic.
Direct internet exposure
Do not expose the device management interface with port forwarding. If remote management is required, use an authenticated VPN. Where external DNS, NTP, or update access is needed, restrict destinations and ports as far as practical.
Operations and records
Track IP address, MAC address, switch port, owner, and firmware version in inventory. Monitor firewall logs and failed login events. Manage policy changes with test and rollback steps.