Mikrotik hAP, switched or routed?

At the moment I've got wrt running on a Pi3 with an extra USB-Eth adapter, which is then connected to an extra switch and wired to (currently) 2 rooms (study and TV/media-player) on the same firewall zone, with my phone via wifi on a different zone (which is how I like it)
The extra USB-Eth adapter and external 5-port switch are a bit clunky and take up a bit of room in my modem-cupboard, so what I'd like to do is replace it all with a single unit.

Ideally, I would really really like to be able to treat each room as a different firewall zone, ie keep my TV/mediaplayer/whatever (which runs god-knows-what software) on a completely different zone to my PC and never the twain shall meet (it's really easy to compromise TVs and use them as a springboard to PCs, so the only way I'm preventing this atm is to just not power them on at the same time). And for future-proofing I'd like an extra routable zone or two, maybe for a home-security/camera system, maybe for a future housemate, etc etc, without adding more devices

One option I was originally looking at is the RouterBoard RBM33G, but then a) I only get 2 wired outputs, and b) I have to buy an extra miniPCIe wifi card to get to my phone.

So I'm now looking at the hAP series.
What I'd like to know (especially from people who may have one or the other): are the wired output ports individually routable? Or are they all just switched and only able to be routed as a single zone?

Their documentation is a bit sketchy in this regard, eg https://i.mt.lv/cdn/rb_files/1556951164hAP-mini-wg-vtech.pdf says, "hAP mini and lite series ... The Ethernet ports are connected through a switch chip" which suggests one-zone and just switched (not what I want).
https://i.mt.lv/cdn/rb_files/1569483045hAP%20lite%20qg%20wnc.pdf says, "hAP lite ... Four 10/100 Ethernet ports" (which tells me nothing)
https://i.mt.lv/cdn/rb_files/1557386020hAP-qg.pdf looks a bit more promising with, "RouterBOARD hAP ... Five individual 10/100 Ethernet ports", which to me means 'individually routable', but then https://i.mt.lv/cdn/rb_files/RB951Ui-2nD-160908145004.png just says, "Integrated Switch".

So does anyone have any of these and can help me out, do any of these models have individually routable wired ports? Or are they all just switched on the same zone?
Or am I stuck buying something like a hEX and then still adding a Pi3 on top of that to provide the wifi to my phone?

If the switch chip supports VLANs (and most modern chips do), then you can separate the ports into individual interfaces.

Yeah, I'd really prefer not to go down the VLAN/tagging/subnetting route (for one thing, there's no guarantee that the downstream devices will even be able to understand VLANs.

I'd really prefer to stick with hardware-routing if possible (and I'm open to other suggestions than Mikrotik, as long as it's a tad bit tidier than a Pi with a few usb-eth adapters plugged in)

You can use about anything as a "dumb" wifi AP for a few phones. If range or being 2.4 only isn't an issue consider one of the inexpensive single band GL-Inet. You don't need the big CPU of a Pi there.

For a central router the RB750Gr3 is a good choice unless your ISP speed is over 150 or 200 Mb. The MT7621 chip serves that mid-performance need well. (The Ubiquiti Edgerouter X is practically the same hardware deleting the USB and SD ports). These have five 10/100/1000 ports and (like almost every OpenWrt compatible box) you can map each one to a different network. This is done by tagging the networks internally but having them each untagged on their respective port. Not a good idea to buy a new router with 10/100 only.

Your downstream devices do not need to understand VLANs (unless you are cascading routers).

Again, I really really don't want to go down the vlan/tagging route. I want a simple hardware solution with at least 4 independantly routable ports (1 in, 3-4 out).

So you're saying that the hEX / RB750Gr3 is only switched and must use vlan/tagging? Looks like that's not an option either then.

I wouldn't mind gigabit, but realistically 10/100 is fine for me, this is Australia and I've just been kicked off my 12Mb DSL and forced onto HFC NBN which runs at 25Mb (max available plan is 100Mb, but that probably only runs at 80Mb, and I don't need more than 10-20 as it is)

I think consumer routers with several independent ports are going to be very hard to find; most (if not all) have just one CPU port (two at most) and a switch in front of it.

It's really simple to set up internal tagging. The ports on the back become eth0.1, eth0.2 etc to the kernel and configuration system and you can treat them like they were separate hardware. You don't have to think about it any past that.