Exactly that way. One port on a Netgate router reserved and isolated and a vpn setup as gateway. Also pfsense set up to block and log any dns leak attempts. From any mobile device I cary an aways on vpn with killswitch. And only tor connection to a node. Takes some time to set up and some fault finding sometimes, because not all vpn connections like tor connections going over them.
