This feels obvious so I am surprised you did not touch on it but, I would point out that you do not need to have every device under a VPN just because you have the VPN on the router level instead. This is what VLANs and policy based routing is for.
All the PG tools in the Router Firmware - Privacy Guides have forums and other resources that provide very accessible guides on how to achieve this.