The Cisco switch looks like it should do what you need.
Keep in mind that in order to prevent traffic flowing between VLANs you’ll need to setup Access Control Lists (ACLs) on the switch. Looks like there’s a Cisco video on this: https://www.youtube.com/watch?v=lzMVLCzc5yk I would dig into some YouTube videos on this switch, since Cisco seems like they’ve posted a few.
Keep in mind, you could get something like an SG1100 for $179 that is well reviewed by Tom here to handle PfSense. You could also get something like this: https://www.amazon.com/Firewall-Appliance-Gigabit-AES-NI-Barebone/dp/B072ZTCNLK you could even use the switch you’re looking at to do the tagging.
Normally in enterprise you’d have routers doing just routing, but for SMB that gets costly fast.