Specific router setting?

Question

ZyXEL

There is a provider that distributes the Internet via cable, without authorization, without binding to the MAC address. Wherever you poke it, it will immediately work there. DHCP provides a "white" dynamic IP address.
In total, the provider gives us 10 (ten) such white direct dynamic IPs on this one wire.
Those. we connect a simple switch to the wire, plug in 5 computers - and each computer receives direct external IPs from the provider via DHCP and work quietly.
Task:
Isolate one of the subnets using a router (put a group of computers behind NAT, set up rules). We stick a router (purchased by ZyXEL Keenetic II), everything works, no problems.
The network has acquired the following form:

Question:
Is it possible to do without an additional switch, which takes up space in the outlet and is essentially stupidly wired to the rack?
The router has 3 wired ports free, just for three servers.
The very need for a router arose primarily for the sake of WiFi - before that, they managed with one switch.
There are three servers, so DMZ is not an option.
I think that we should smoke in the direction of VLAN, but whether our router supports such functionality is not an easy question. It was not possible to set it up right away, only to completely disable NAT, then the router essentially works as a switch + WiFi access point.

Answer 1

It's elementary. You need to remove 3 ports from LAN-brigde and create a bridge from LAN1-3 and WAN.
Your router supports this functionality, refer to the instructions on the Zyxel website.