We attempted to set up VLAN's on our network. That was a couple of years ago and I don't remember the specifics, but there were some complications that prevented VLAN's from being recognized properly on some network equipment. We ended up just plugging each network into the firewall directly and have allowed the firewall to keep the networks separate.
You don't need to do VLANs. Just firewall rules that don't allow network A to send packets to network B.
In my simple mind, there is a certain amount of comfort in knowing that the networks are absolutely, physically separate from each other until they reach the firewall.
And you're trusting the firewall to not to violate policies set in software. You should trust routers to do the same thing one step earlier.