A dumb and simple solution is separate physical routers for the home stuff and for the homelab stuff. Each group of clients is behind its own NAT.