Actually, VLANs are technically physical separation. As for what to do with IoT, you can always configure another SSID, with yet another VLAN. At that point Untangle has yet another interface, as well as an IP range to define a whole new set of rules under.