I'm designing a network that basically needs to separate staff network and customer network. The client currently has a standard ISP modem/router that has no VLAN capability or any ability to separate traffic. I've suggested we should only need an EdgeRouter which will handle one network (guest/customer network) and then the ISP router will handle the private staff traffic.
We can't remove the ISP modem, as the modem currently does SIP and the ISP doesn't provide SIP details, this is why I'm restricted to having to keep the ISP modem in the design.
ISP Modem/Router -> EdgeRouter -> Access Point
ISP Modem/Router: 192.168.15.1/24 - Main WAN Router. Staff LAN, will have an SSID. Connected directly to Eth0 on ER.
EdgeRouter Eth0: 192.168.15.2/24 - WAN interface
EdgeRouter Eth1: 172.16.0.1/24 - VLAN100, LAN interface
Ubiquiti Access Point: 172.16.0.2/24 - Tags all traffic as VLAN100
Firewall rules to allow access from 172.16.0.1 to internet and back, but no other networks should need to communicate and essentially shouldn't see each other.
I do understand VLANs, but I'm unsure if VLANs are even necessary as both networks will be operating in different subnets anyway. Would it be better to VLAN them anyway, as someone could change their IPs on a device to match the other subnet? But I don't want to complicate the network to much, there is only need for one access point. Am I designing this correctly, or should something be changed?
Would really appreciate everyones input!