The first plugs into your "Internet modem/router". Connect all of your "untrusted" devices to it. Your second router also connects to the first, just like the other devices do. Your "trusted" devices will connect to this second router.
Your "trusted" devices (PCs, laptops, tablets, etc.) will be subject to double NAT and, of course, NAT is not a security feature but this second router will provide a bit of separation between your trusted and untrusted devices by way of NAT and stateful firewalling, just as it would protect your internal network if it were connected directly to your upstream ISP's network.
Again, this isn't ideal but it would work for the average home user and it eliminates the need to deal with/learn about VLANs or buy special hardware that supports them.
This VM that I'm typing in is behind at least eight NAT routers. There's the pfSense perimeter router, and at least one router between that and the ISP. And then there are three pfSense VPN-gateway VMs, each with NAT by the VPN server, and local NAT to a VBox internal network.
In any case, you're counting on the router to keep one LAN/vLAN isolated from the others.
Suppose your router does not have VLAN support, and you do not wish to replace it. Can you add sufficient VLAN support to your network by adding switches with VLAN support?
TP-Link has a couple of switches (TL-SG105E and TL-SG108E) [1] that are not full managed switches but do more than common unmanaged switches. They are priced about the same as unmanaged switches. I got the 8 port model for $30.
These switches have some VLAN capability, although I haven't looked into what it can do. (I got it for its port mirroring ability, not its VLAN ability).
If you are using your ISP's router/WiFi access point, and your IoT devices use WiFi then I'd guess there is not much you could do with switch-based VLANs. The Hue bulbs, though, talk to a Zigbee hub that you plug into your ethernet, so you can make all the Hue traffic go through a switch.
Another problem is that nearly all the documentation I've found on using VLANs gets real "enterprisey" real fast. For even fairly sophisticated home users it is probably really confusing, and so even if they have a router with good VLAN support they might not be able to figure out how to use it.
[1] https://www.tp-link.com/us/home-networking/5-port-switch/tl-... (SG108E is essentially the same, just with 8 ports instead of 5).