Segmentation Scheme for Frontier fiber -> Eero Pro 6 router

Greetings, we have a community center with 5 eeros all hard wired from a 28 port managed switch. We are on Frontier fiber ONT -> Eero pro 6 router -> managed switch -> stuff.

Frontier fiber and eero wifi is a fantastic user experience.

I am trying to design a segmented network where our security and infrastructure are separate from the entertainment and exercise so that the wifi users can connect to the entertainment and exercise devices but not the IoT.

I've spent quite a bit of time in this community and seeing mostly "can't" but not ideas. I have read the eero 6 pro does not support vlan tagging. and know my TPLink managed switch does.

I tried eero guest, but on guest wifi cannot connect to other devices even if device also on guest. So now I am looking at bringing all users, entertainment into same network as infrastructure - and am scratching head on how to do that. I appear to only have two choices, all internal network, open on one subnet - or internal secure and guest network with no east-west connectivity.