I've done that a few months ago on an ubiquity router. Two VLANs, one with normal access and one with a Wireguard tunnel into my self hosted dropplet that also runs pihole. Works like a charm.