@tac57
I agree with @JKnott. I don't think a DMZ is what you want for your IOT network. If your IOT devices are truly on a normal DMZ setup, the are exposed to the internet and anyone can find and access those devices. They may be insulated from the rest of your network, but they are susceptible to intrusions from outside your network.
I do think setting up some VLANs is the best option. This keeps the IOT device behind your firewall to help protect against intrusions, but also separates them from the rest of your network incase there is an intrusion.
Honestly using two IOT VLANs is probably the best option. Use one for devices that need to access the internet to work - such as streaming devices, smart TVs, etc. Use another one for devices that don't need to connect to the internet such as CCTV systems, smart plugs/lights, etc.
Of course you can do this with one VLAN and just create an alias and corresponding firewall rules to allow devices to connect to the internet while blocking anything not listed on the alias. But that requires that you manually add a new device to the alias list whenever you want to allow a IOT device to connect to the internet. By using two VLANs, you can simply connect a new device to the corresponding wifi network (the one that has internet access or not) and not have to manually change anything in the firewall.
I would assume you can use two of the three guest wifi networks for these two IOT VLANs. This still leaves you with one guest vlan and hopefully your regular wireless LAN network. If for some reason you only have a total of 3 wireless networks available, I would probably set it up like this: regular LAN wifi, no internet IOT wifi, and a combined guest/internet IOT wifi.
