VLANs are what you need then, Linux supports them well and most OpenWRT devices will too.
I’ll check this later, but as I remember it:
Linux side, eth0.1 is a VLAN interface that sets tags on outbound packets, this is extra data in the ethernet frame so both ends have to be aware.
eth0 > bridge0 > OS and LAN avalable VMs (if any)
eth0.1 > bridge1 > isolated VM
There are instructions all over on how to do this.
In the Switch section on OpenWRT, create a new VLAN, and for the port leading to your VM host and select tagged for that port, and the CPU port
Now make a new Interface (eg LAN1) and define it’s forwarding as you like (LAN1 > WAN allow, LAN1>LAN drop etc)
give LAN1 a static address in a new subnet (eg LAN is 192.168.1.1 so 192.168.10.1
jump back to your linux box, manually add 192.168.10.2 to bridge1 and try a ping and if it works your VM should be able to do the same. You don’t actually need an address on ‘bridge1’ permenenatly, and in fact not having one could be seen as more isolated too.
Please make backups of course, my experience with this is good but you could lock yourself out of the router with an error.