Advice on VLAN configuration for home

I managed to configure VLANs using FreshTomato on my Netgear R6400 router. I'm still testing things, but I wanted to get some advice on how many VLANs I should setup and what I should use each one for. Based on what I'm seeing I'm able to establish 4 bridges each with their own subnet range. I'm not sure if this means I'm limited to 4 VLANs, but that's what I'm assuming so far.

If this is the case, I'm thinking about having VLAN1 (br0) be my main network for my personal devices like PCs and cell phone. This would have full access to the rest of the network, router login, and internet. VLAN2 (br1) is one that I've decided to dedicate for my analog camera DVR. I have disabled access from this VLAN to other VLANs. I'm also planning on disabling WAN (internet) access from this VLAN. I'm able to see the DVR from VLAN1, but nothing on VLAN2 can communicate back to VLAN1. I've tested this and it seems to be working. I want VLAN3 (br2) to be my guest network. It will have internet access, but no access to the rest of the network. If I'm able to set it up, I'll also put some firewall rule to prevent users on this network from seeing the router page, but it's not a big deal if I can't do this. I have not setup a fourth VLAN, but my plan is that I'd use this VLAN for IoT devices that require internet. I'd have it setup similar to VLAN2, where I can communicate to VLAN4 from devices on VLAN1, but not the other way around. The main difference is that they would still be able to get internet access.

So that's a summary of what I plan my home network to be like once I get everything running. I've gotten almost everything setup except for figuring out how to block internet to VLAN2 and router login. Does anyone know a firewall rule for doing either of those? Blocking internet to VLAN2 is a requirement.

A few things I was still not sure about. When I first flashed this router with FreshTomato. I noticed that the predefined Netgear guest networks were not bridged to anything. Does this mean that I could create a guest network doing the same thing? Do I actually need virtual SSIDs and LAN ports bridged to anything if I don't plan on giving IP addresses to guest devices?

I also have a printer that I'm not sure where I should put. Would it be okay if I put this on VLAN2 with my camera DVR? Or should I put this on the VLAN4 with my other IoT devices with internet? I would prefer the printer to not get onto the internet, but I don't know the risk of it sitting on the same VLAN as my camera DVR.