As @Gertjan says do not use USB. I can personally tell you that is not the best idea. It might work, but you can also get unexpected issues. When I was first starting out with pfSense I tried that on a tiny mini PC and well if you want to know how that went, I stopped doing that pretty quickly. Details here in case you really want to know, https://forum.netgate.com/topic/122317/solved-pfsense-is-not-making-sense.
When you are new to pfSense, there is already a learning curve, so you don't want to shoot yourself in the foot like I did by using unsupported (not officially supported) hardware like a USB nic.
Hardware requirements are minimal. Even a 10 year old PC will be overkill for most common applications. I can also vouch for that because that was what I did after the mini PC issue. The only issue with that will be power usage. If you're not concerned about power usage, go with the old PC and cheap PICe add on intel nics (preferably intel). Watch out for fake intel nics being sold online. If power usage is an issue, the laptop with the VLANs on a single interface as suggested above could be a good choice too.
Edit, I forgot about the AES-NI requirement. A really old PC may not support AES-NI so that could be an issue later on down the road when it does become a requirement. Make sure whatever you end up making your permanent hardware has a CPU that supports AES-NI. In the meantime if you want to get something up and running and play around with, it won't matter.