PfSense Router + L3 Switch - Separate VLANs

[JT40]

Hello,

I'm on the way to buy a PfSense box, or sort of.
I'll have 2 different physical network cards of 1Gbit each, but even if it was only one, the question would be the same.

Can I add a L3 switch afterwards?
The goal is to have high bandwidht between VMs, NAS etc... Something that the PfSense box can't do, too busy with the WAN traffic.

My plan is to add 2 switches after the PFSense box, each switch would belong to a different VLAN.
Is it possible?
The machines in different VLANs should be able to communicate based on precise protocols and ports ONLY, so it cannot be a simple L2 switch, but a L3 switch, right?
The biggest doubt is if it causes issues with the PfSense box, in which there are already 2 network cards that support also switching (obvious?).
As far as I know, with a L3 switch there will be no need for the PfSense routing capability, the L3 switch is gonna take care of it, right?

What switches do you recommend??

One of these switches will also have APs for WIFI, any recommendation?

Possibly opensource stuff.