Recommended Network Configuration

You're not wrong.

Hummm....
See: Separate subnet on physical port #4
And: Use WireGuard interface for specific devices only

You can also make a separate WiFi SSID for the children, and attach it to the second LAN.