I use managed switches for this, L2 units are fine if you let opnsense do all the inter-VLAN routing. All network devices go into the switches which are connected to the servers. As CptKriechstrom mentioned my PON or modem is connected to a switch and is tagged into a VLAN, which enters opnsense through that specific virtual interface.