Not stupid questions at all.

can I do this all with a single switch?

You could technically do all of this on a cheap WiFi router running dd-wrt firmware. VLANs on ports, multiple WiFi SSIDs, the whole thing. I have. But it is all hacky finicky configuration that is annoying to do, and I will never do it that way again. There is something to be said for owning and using products that “just work”, especially if you have a family that relies on your network and network services being stable.

To answer your question directly, you can do everything VLAN related except the WiFi portion on one wired switch, but you are going to need a router to do anything meaningful with those VLANs.

Do I need a separate access points for each VLAN or can I have multiple vLANs on a single AP?

One AP can serve multiple SSIDs, and can map them each to a particular VLAN. The ability to do this depends on the Access Point.

How many ports should I be looking at on my switch? Would four be enough for my set-up?

Definitely definitely definitely get more than you think you need. You are already doing cool stuff, and will likely add more of it over time as you gather more ideas and experiments. I wouldn’t do less than 10 ports in your case. Nothing is more annoying than running out of ports capable of VLANing and having to upgrade the gear and redo the configuration on a new device. Your time has value, and IMO it is more expensive than just spending a few more bucks on the right gear that is nice to configure and just works.

Also managed is best right?

Absolutely yes. The term managed is going to have different meanings depending on the age of the gear and the “level” of the gear though. An old Cisco switch would be the traditional definition of managed. New ubiquiti gear with its software defined networking would be managed also. Hacking around with the config on a dd-wrt router would be considered “managed” too, in my book. You can’t really achieve VLANs without some way to configure them, and management is that configuration method, when you boil it down.

There is more stuff you need to think about, like how to route between your VLANs, and the filtering you will want to apply to that routing for security reasons. You are going to need a router, and picking one that is right for you is probably going to be the trickiest thing, because you seem like the type that isn’t going to be afraid to do more complex things over time, while also keeping budget in mind.

I’ll cut to the chase. I have the network you are trying to do, and I’ll tell you the gear I’ve settled on, for your reference. I recommend it, but of course I am biased, so really just use this as a reference and make your own decision. I’ve had all kinds of gear over 2 decades, and built and worked on enterprise networks of all kinds, and this is what I’ve settled on for me as good enough for the kind of stuff you and I are into.

I have a 10 port ubiquiti gigabit managed switch with a handful of PoE ports. It’s got PoE to power a (now lightly outdated) ubiquiti WAP. The WAP and switch are configured by a piece of software from ubiquiti I run on a computer (it can run on a pi, do monitoring and all kinds of cool stuff, but I don’t bother because I just use it occasionally to change config here and there). The software lets me config VLANs on the switch and WAP, which also lets me plop WiFi SSIDs on those VLANs. I have multiple separate WiFi SSIDs served from the single WAP; one for guests, another one for home automation and WiFi cameras, another for everything else.

My router is a pfSense that I built from gear from pcEngines, because the official pfSense gear is 3 times the price, and the affordable hardware of theirs is not the most reliable. I chose pfSense because it is a good balance between cheap, and does almost any networking thing possible while being easy enough to achieve it. Updates are also free, which is a big deal. You could pay through the nose to get the simplicity of a ubiquity router, and it still not be able to do everything you want to do that you could with a pfSense. That said, the ubiquity does a lot with ease, you just pay a premium for that convenience. If you like to learn and tinker, I recommend pfSense, because it’s easy enough to mostly point and click, but it doesn’t stop you from making something really intricate just the way you want, if you like. It’s a BSD box under the hood, after all.

Anyway, long story short, my router lets me reach my WiFi cameras and home automation gear that are on their own isolation VLANs from my main VLAN, but those cameras and stuff can’t reach back into my main VLAN nor reach the Internet because of the filtering rules I’ve defined on the router.

You will probably have more questions now. Never fear though, this stuff is doable.