After some tests I can also conclude: VLAN isolation works with that configuration, this was not wroking with the previous config, were you have seen the VLAN traefik also on the interface with the MGMT ip (although it was tagged traffc)