I think entirely separate VMs in different VLANs might be a bit much for a beginner to setup correctly. The Isolation that Docker and it’s networking Provides might be enough to start, no?

Is there a good way to watch the streaming services on your TV without trusting either Google/Apple/Amazon to not spy on you with their hardware?

I have an Nvidia Shield TV. With 150$ its outside of your price range, sadly.

But: I’ve been running this thing for 7 years now and its still trucking. Compared to other smaller streaming sticks that have become unusable because of bloat firmware updates over time.

You can install custom firmware on it, but my understanding is that when you want streaming apps like Netflix or Disney to give you more than 720p output, you need the official OS.

If you want to Dodge the ads on the launcher, there are alternative launchers that can simply be sideloaded.

I don’t use Jellyfin but I have all my movies on an SMB share that I’m accessing via Kodi. The hardware is strong enough to decode any format you throw at it.