Most new routers have guest network, and internal network. Put your work laptop on guest network and that should do the trick.

My solution: Guest WiFi. My router has an isolated guest WiFi mode.

The point is just that you shouldn’t trust work issued devices. They are never going to be as secure as your private network, unless you have a big family or are a high profile target.

Depends on the hardware, even consumer networking hardware often support VLANs. Sometimes it's hidden behind settings, other times you'll have to use something like OpenWRT. Some hardware lets you run multiple APs at once, and you can have an AP for your VLAN.

Sometimes it's cheaper/easier to just buy a shitty router to use for your untrusted devices.