vlans are not a means for security
VLANs alone are no means for security. Segregating hosts using VLANs and controlling the traffic between them by firewalls is.
if we create vlans with same network, control systems wont be able to communicate to the downstream devices due to vlan id in the ethernet packet
That is the purpose of a VLAN in a data link layer (L2). It separates its traffic from the rest of the network.
Separating hosts in L2 means they can only communicate using the network layer (L3), forcing them to use gateways/routers. Those gateways are where you control the traffic. Of course, hosts in different VLANs also need to be in different IP subnets for routing to work.
If you require contiguous L2 connectivity then you cannot separate those hosts using VLANs. Modbus can run on top of TCP/IP, so it can be routed.
In your case, the Tofino firewall (or an additional router) needs to connect the separated IP subnets. Using firewall rules, you permit specific, required connections and deny all other traffic.
On the switch, create the required VLANs and assign device ports as untagged. Towards the firewall, define a VLAN trunk with all VLANs tagged.
On the firewall's trunk interface, create tagging VLAN subinterfaces and assign the IP subnets. The north-facing port towards the control systems uses yet another subnet.
Then you define the firewalls rules, e.g. allowing a specific control system access to a defined Modbus device or subnet.