If you are afraid of being ddosed which is very unlikely. Cloudflare has free ddos protection. You can put some but not all things behind their proxy.
Also instead of making things publicly available look in to using a VPN. Wireguard with “wireguard easy” makes this very simple.
VLANs do not make you network magically more secure. But when setup correctly can increase security a load if something has already penetrated the network. But also just to streamline a network and allow or deny some parts of the network.
If you mainly use containers perhaps OpenSUSE Micro OS is of interest to you. Other then that pretty much any distro will do. I use rocky Linux my self for a few different things.
If you want to try out many different distros virtualization is also a option. KVM or something like XCP-NG with XO or proxmox are great options.
On one hand I love unify on the other I wish i never went this route. They do make it very simple to manage a whole suite of devices. But updates sometimes feel “Alpha/beta” some more advanced stuff requires editing jsons in the devices them self. Also recently the battery in my cloud key gen 2 has blown and their is no way to replace it without replacing the whole cloudkey. Thing lasted like 2 years. which is ridiculous. Personally I have started to look in to Mikrotik which is a load more advanced and has a higher learning curve. but if I am forced to edit jsons and use scripts to do some more advanced things i might as well.
Sorry for the slight rant… just be aware what you can get your self in to.
Say you download from the clearweb then use a VPN. Then reseed that downloaded file straight to I2P.