Traffic in separate VLANs doesn't mix. No device in one VLAN can directly talk to a device in another VLAN. Any communication between them needs to happen across a router.
You could define a VLAN for WAN traffic with the router's WAN port and the WAN modem in it and another VLAN with the router's LAN interface and your internal computers and servers on it.
Simply think of ports connected to the same VLAN as connected to the same switch and ports connected to different VLANs as connected to different switches.
(Connecting a WAN interface to a managed switch has some caveats. You'll want to deactivate or secure all functions on that port that could compromise or disturb your internal network - STP, LLDP, CDP, MVRP, ...)