Separate subnet on physical port #4

Yes. From your picture, it appears you will do the following to accomplish this:

  1. First, be certain LAN 4 is labeled in the correct order - SEE TABLE OF HARDWARE
  2. Use WI-Fi, LAN 2 or 3 to complete this (in case the ports are labeled in reverse)
  3. Add VLAN 3 to CPU/eth1 as "Untagged"
  4. Remove VLAN 1 from LAN 4 by changing it to "Off"
  5. Add VLAN 3 by changing it from "Off" to "Untagged" (verify this in Switch documentation, as my CPU has these tagged by default)
  6. Hit "Save and Apply"

Port 4 should now be on your new VLAN 3.