Look at them like this: VLANs are like running several cables between two spots that you can configure independently. In the very end it comes down to this: what virtual LAN number you have on the cable.

Your backbone devices (router and switches) can be configured to accept tagged traffic―your switch will send a packet prefixed with a VLAN index and your router will trust that the packet actually came from that VLAN on the switch port, or to tag traffic―like when you have some port on your switch where your PC is plugged in and the switch will tag those packets with some VLAN when it forwards them (to the router).

Once you grasp that, everything else pretty much boils down to managing several isolated networkd and how they cross-talk. You run a dhcp server over each network, its own set of other services and whatnot.

Oftentimes the “home” hardware will expect a single network and use some means of packets broadcast to reach each other. That’s how your phone can find all google homes on the network and apple homekit knows where your smart lights are. For that traffic to cross VLANs you’ll have to use some special software like mdns repeaters, but you can still isolate them.

Wrapping up, VLANs basically allow you the physical level isolation over a single cable. Mind that there are, of course, some bugs, e.g. I once found an issue with Unifi access points that allowed a well crafted packet to escape into VLAN 1 no matter what it was supposed to be tagged with. So don’t treat them as physically separate links.