@sgw The theory for it is relatively simple but in practice, it may require some planning due simply to the nature of virtualisation. If you have a firm grasp of the technology, it should be straight forward however.
There are essentially three modes for vlan tagging in vSphere: external switch tagging, virtual switch tagging and guest tagging. It is all here.
You are correct that you'd need separate vswitches for both the internal and external networks but depending on how you want to manage the internal vlans, you'd want to pick one of the above three methods. I suspect that for the majority of users running pfSense virtualised, you'd want pfSense to manage the vlans so VGT is the preferred route. Your external switch is configured to pass all vlans to the trunk/access port that pfSense is on and esxi will preserve the tagging when it forwards it onto the VM.
For the management vlan, even if you have a single vswitch configured to accept all vlans, you can have another switch (on the same vmnic) configured for a single vlan that is also within that other wider vlan group. The usual good practice of moving the native vlan to anything other than the default vlan works in this scenario.
A word of advice is that if you plan in future to use vSphere HA, you may want to save yourself the trouble later down the line by setting up your project with HA already up and running rather than migrating everything to Distributed Switches later.
