It's not easy to find appropriate managed switch [..] I'm afraid it might lack some specific features. Usually it's Layer 2 switches, while there are some more VLAN features only on Layer 3.
ISPs generally use 802.1Q-tagged VLANs, and those are entirely layer-2. (Some switches support "Layer 3 VLANs" or "IP VLANs", but those are not the same thing as 802.1Q VLANs. You practically never need these features.)
As long as your switch declares 802.1Q VLAN support, it'll work... The real problem is that the router also needs decent 802.1Q support.
my main question is still if such switch would work in general, or if it's behind the router - router will trim "VLAN" data
VLANs are a layer 2 feature and work "under" IP – so they are terminated at the router just like real Ethernet connections would be. Each VLAN acts as a separate virtual interface, with its own IP subnet and routing.
(And just like real Ethernet connections, they can also be bridged; indeed your ISP router is most likely configured to bridge the IPTV VLAN 6 on both sides, while still routing between LAN and the Internet VLAN 2.)
So in your plan, it is not enough to just have a managed switch that'll untag/demultiplex the VLANs – the router needs to be able to (re-)tag them in the first place. In other words, your Asus must support 802.1Q VLANs on the LAN side, not only on the WAN side.
For example, to "transfer" IPTV VID 6 through a router, you'd (in generic terms):
- create a tagged VLAN 6 on the WAN side,
- create a tagged VLAN 6 on the LAN side,
- create a bridge between the two (WAN.6 ↔ LAN.6).
(Note 1: Doing the same for the Internet VID 2 makes no sense – you don't want your game console or random other devices to directly be "on the Internet"; you want them to be on your LAN first and go through the router for Internet access. Your LAN is not the same VID 2 as the Internet VLAN.)
have another much better router - Asus RT-AC68U (with Merlin firmware), so it's a shame I'm forced to use cheaper one provided by provider. I'm still trying to configure it [...] Seems like there is no easy option to configure Asus route like provider hacked their own routers
802.1Q VLAN tagging is actually a quite standard feature among higher-grade routers, so it's a shame the expensive Asus lacks features that a cheaper ISP device has. (Buy Mikrotik or Ubiquiti.)
On a less snarky note, I found a forum thread mentioning that 802.1Q tagging is in fact available on Merlin firmware, but only through SSH command-line and not through graphical interface.
So if that advice from 2014 is still valid, then you should be able to use
nvram to configure a LAN port with multiple 802.1Q VLANs on it.
However, if your router's firmware absolutely doesn't support 802.1Q on LAN ports, you can still achieve a similar result using port-based VLANs, which you mention that your Asus does support. But you will need some device which is able to tag/multiplex the VLANs onto one cable. That means buying a second switch and connecting them like this:
router switch 1 switch 2
port 1 (tagged 1+6) ======== port 1 (tagged 1+6)
port 1 (LAN) --- port 2 (untagged 1) port 2 (untagged 1) --- console
port 2 (IPTV) --- port 3 (untagged 6) port 3 (untagged 6) --- TV
A downside of this method is that you lose more ports on the router, but it is compensated by having a bunch of spare ports on switch 1 instead.
(Note 2: Yes, it is possible to bridge the physical LAN and WAN interfaces and get all VLANs passed through... but then the router will no longer act as a router. Remember note 1: Your LAN is not the same VID 2 as Internet VLAN.)