There’s some good and bad advice thus far, but a very relevant set of questions to probably many people. So let me offer one more perspective, from a networking professional point of view.
First, your thought process in terms of the questions is correct. You just have to approach this from the perspective of the likely threats.
First, an attempted simple explanation of VLAN vs subnets (happy to get deeper if you have questions) and why you care: A VLAN, or broadcast domain, is a set of devices that can communicate without crossing a boundary (they don’t even have to use IP, and all you need is a switch). A subnet is a range of IPs. To communicate across subnets you have to cross a boundary, provided by a router.
A firewall (like your USG) is just a router with a more comprehensive set of security features available at subnet boundaries. You will typically have one subnet mapped to each VLAN. Most consumer routers have a switch built in (those “LAN” ports - you dont cross the routing engine moving packets between them as they are in the same VLAN. You do cross a subnet boundary when talking between the LAN and WAN ports. More advanced devices let you define multiple VLANs and assign ports to them, allowing you to force traffic between distinct VLANs to cross a subnet boundary where you can enforce security rules.
More advanced devices like Ubiquity can carry multiple VLANs on a single NIC in the form of sub-interfaces. This is called a trunk. The trunk can go to a switch that then breaks out individual ports into individual VLANs for individual devices.
Now some common threat vectors:
A - Inbound from the Internet. By default, on residential ipv4 connections (99% of US), by virtue of being behind a NAT, nothing is open. Only outbound connections are allowed. Disable upnp. If you manually open a port, you have now compromised the target device. You now better be sure the service you jsut exposed (SSH, web server, etc) is secure and kept secure. E.g. The service is on something that gets (and you keep up) constant security updates. This applies to something like an active Linux distro, but does NOT apply to anything “IoT” that gets firmware updated roughly never.
B - Lateral movement. If A fails and a device gets compromised (I’ve had my Synology NAS turned into a bitcoin miner when I was sloppy - could have been worse) that attacker now has access to use the device as a jumping off point to compromise anything within the same VLAN/subnet without any further hindrance. So, if you are going to open ports, put the target devices into their own “DMZ” subnet. Let’s call this Zone-DMZ.
C - Cryptolocker / protect the NAS. In my opinion, the worst attack is one that would encrypt, destroy or steal data on my NAS (have backups, but thats a separate discussion). So unless your NAS is solely for junk (movies, other replaceable, non-sensitive media), keep it in your most protected zone. For me, that’s a subset of your Primary Devices + NAS: NAS, PCs, laptops. Lets call this Zone-Internal. Mobile/tables don’t need to be here. They are more vulnerable because installed apps are vulnerable to malware, so keep them away from your PC/NAS.
D - Firmware from China. Another real threat vector is “pre-compromised” firmware on IoT devices. Here it might be a malicious or supply chain compromise, or jsut weak security that can be exploited when the device phones home, either knowingly by those who wrote the firmware, or through trivial redirection of those calls home by an attacker. You do not need to open ports pointed at these devices for them to be compromised. So we’ll put these in Zone-IOT so all they can do is further infect each other, but not DMZ or Internal.
Each “zone” as I have called them is a distinct subnet/VLAN. So for purposes of network segmentation here zone=subnet=VLAN. So an example of how to segment your network and not get too crazy:
Internal: Nothing that gets direct connection from the internet. Must protect these. PCs, laptop, NAS.
DMZ: Anything that you open ports to. Also reasonably trusted “smart” devices: TVs, Roku, Echo. Your tablets and phones go here, and they will have no trouble streaming/casting to your smart TVs and such. Your HA goes here. If you undertand and trust the code on your ESP it goes here, otherwise IOT.
IOT: The untrusted, never updated firmware, garbage goes here. Wifi smartplugs/switches. Wifi sensors. Your guests go here too so don’t call the SSID associated with this zone “garbage” as you’ll have to tell your guests to use it 
Cameras: Tough one. The firmware on these is generally garbage. But their content is sensitive so we don’t put them in IOT. So you may want to make this a separate zone but don’t give it more trust than IOT. Can put this in DMZ if you buy decent brands and keep them updated.
You will create rules that, for example:
1 - Allow all traffic to the internet from each zone.
2 - Allow all traffic from Internal to any other zone. NOT the other way around. So from your PC you can access anything.
3 - Allow some limited traffic from DMZ to internal. E.g. if you need to give a Plex instance in DMZ access to movies on your NAS in Internal, allow CIFS/NFS in that direction.
4 - Allow HA in DMZ to hit your wifi switches/sensors in IOT on HTTP/HTTPS.
5 - Deny all other traffic.
Now lets get to you questions:
- Is it something I need or should i just leave things as they are?
Yes, you should do this. The security landscape is too terrible not too.
- What should i use vlans or different subnets, what’s the difference here?
Each “zone” is a unique subnet+vlan. Examples of zones above. Within a zone, things aren’t protected from each other. Across zones, you define the firewall rules.
- Does the grouping i mention above sound right? or do i have it completely wrong. Devices will be visible through groups right? (excluding the guest network i guess)
A bit sub-optimal in my opinion, but discussed above. Create 3 classes basically: Must protect at all cost, everything else, don’t trust at all.
- Will i see an increase in browsing speed and camera stream responsiveness?
Unlikely to notice. If devices are broadcasting gargage, those packets won’t cross VLANs. But it’s unlikely this is a serious problem on a home network.
- Where should i place the HA machine that runs the adGuard DNS server?
DMZ is fine. Your router/firewall can communicate with it anywhere, but you may have to write a rule to allow it. It can go in Internal if you are very careful about keeping that HA instance secure.
- What are the security benefits?
When (not if) one of you devices gets exploited, further damage is contained. You will also prevent likelyhood of exploit by following these guidelines.
- Is it perhaps a big leap for me? Should i hire a professional to set it up? (Someone on Fiver perhaps to do the initial steps?)
No. This stuff is not rocket science. Your train of thought is correct. Now just execute. One small step at a time.
- Could you please point me to some basic-level reading material to understand what is up and how to set all these things up?
This would have to be vendor specific to your hardware. But armed with the right concepts/questions your google searches will give you easy answers. Here is a great resource for learning basic networking concepts: http://tcpipguide.com/free/index.htm
Good luck.
