For your reference, here is some basic networking info.
If you are not already familiar with the OSI model, start here: https://www.geeksforgeeks.org/computer-networks/open-systems-interconnection-model-osi/
A vlans work in layer 2 of the OSI model. You are talking about higher level things that can be achieved in part by vlans but it is very important to understand how things work at lower level. A vlan is simply a extra tag on a ethernet frame that tells upstream devices what lan a frame belongs to. You can configure a switch port to tag untagged traffic but pure switches themselves don't do any routing and thus there are no ACLs or any other layer 3+ things to configure. https://en.wikipedia.org/wiki/Ethernet_frame
By NGFW think you are referring to Next generation Firewalls which are different than network switches. Firewalls operate in layers 3-7 and thus don't see or control anything in layer 2. Next gen firewalls are really only something you see in a enterprise environment and even then they tend to be more marketing than anything else. If you want a firewall you need something with a decent CPU that can track states and handle routing.
A managed switch is a switch that can be configured to do vlans and other layer 2 technologies like spanning tree. Most switches support hardware accelerated switching but in some cases switching is done by the CPU. On a small layer 2 switch you don't want to be careful that you aren't doing any routing (or anything else CPU heavy) as the CPUs present in layer2 switch chipsets tend to be very weak since they are only designed to configure the hardware via control registers. The reason I bring this up is that OpenWRT will happily let you configure a device anyway you see fit which can lead to really bad performance if you don't know what you are doing. Additionally OpenWRT doesn't support some hardware features like cable diagnostics and layer 2/3 filtering like I said previously.
Apologies if you already know all this. From your writing I got the impression that you were new to networking.