Welcome to the forum! 
TrueNAS (well, anything that runs ZFS) needs direct access to storage (no virtual drives, no hardware raid controllers). If you can do controller / pci-e controller passthrough through xcp-ng, yea, I guess you could try it. TrueNAS core is just a fancy web GUI for ZFS and some services, like Samba, NFS and some more, don’t really remember (also, it has packages for other certain software, like I believe Nextcloud, I don’t know if they are docker containers or FreeBSD packages or jails).
Personally, I’d recommend Proxmox, which you can run ZFS on. The base OS behind it is Debian 10 (on proxmox 6), so you can run ZFS and Samba directly on it. I’m just assuming you like Debian, so I believe Proxmox would be a great fit for you. Nothing wrong with XCP-ng tho’. And being up and personal with the terminal is, I believe, better than using GUIs (I used FreeNAS for a small while, I liked the GUI, but when I came to be face to face with Proxmox / terminal, I had no idea about the ZFS commands, so I had to start from scratch - I’m still no expert, I’d argue I’m still an early beginner in ZFS). If you want more control over your storage, again, passthrough the controller to a VM running TrueNAS core and make the ZFS pool and the Samba share on the VM. But since both Proxmox and XCP-ng supports ZFS, I think it would be better to leave it to the host OS and maybe if you’re ultra conscious about security, make a VM, allocate some storage to it (preferably raw format) and install samba there. Based on the fact that you share your Plex instance with roommates, I don’t think security is too much of a concern to you (but it could in the future). At least make sure you prevent unauthorized access to your server.
For the network, I’d recommend you run pfSense on a separate hardware, like an Intel NUC (or similar) with 2+ ethernet ports, or like I do, on a low power consumption board, like the ASRock J3455M (and if you’re insane like me, rack mount it - I believe what I have is completely overkill, you can get away with 2 cores if you don’t do a lot on your router / firewall, I only run OpenVPN and HAProxy on top of the core pfSense utils). Get a managed switch if you want more security on your network. If you only want to run internet to that R420 only, you can skip the switch.
Judging from your currect requirements (“a blog, 2 websites, nextcloud and plex”), I don’t think you need L2ARC (ssd caching). IMO, just get more RAM (64 GB should suffice, go with 96 GB if you want to run a ton of stuff), ZFS loves it (make sure it’s ECC).
Great, now I’m depressed because I run in production a Dell R320, R330, R420, 2x R430, R530 (and some other random HP and Intel servers), while other people are buying R420s for home use. At home I still don’t have ECC in my home lab. Probably that won’t change too soon.
The above is what I would do personally and is just my opinion. Maybe someone with more experience can explain why in my (and your) case we should go with something else.