Router -> all vlans (trunked / tagged) into managed switch, then you do the routing there. Thats how its done usually.

You can then assign ports of a switch to only accept/output a single vlan directly (untagged), so the devices dont need to be vlan aware. Or you output only needed vlans as tagged, for example for an accespoint or server.

You can do the same in virtual nerworks like inside proxmox, all vlans on one bridge and then set the VMs to single vlan

If you are going the intel 35W cpu route, why don’t you just grab an m720q or m920q?
Way cheaper, way smaller, less power consumption.
If you really like tinkering, you can fit a dualport 10Gbe NIC, a 2.5Gbe port, two NVMEs and one SATA SSD into that tiny m920q. Combined with 64Gb of RAM.

Grab a used one for cheap on ebay. Or a quad port Gigabit NIC instead the 10Gbe NIC.