Hi,
I have some experience with networks (mostly win2kserver, almost no linux) but in no means an expert.
I want do start doing things properly (Linux style :P)

I want to set up linux machine for learning and serving stuff (raspberry pi) with SSH accesible on the internet, but I do not want to compromise my home network.
I have static ip and can forward ports.
I use MikroTik router - currently basic setup as NAT router.

My idea was to make VLAN on router using one of the ethernet ports with only raspberryPi connected.
I do not need (or even want for home network security) local connection betwen my compouters and the server.

Is this the proper way?
What steps should I take to secure my MikroTik router from outside threats (besides good password and not pressing buttons i dont know what they do :P)?
in case of server being hacked, How can i block any connections from server to router itself besides traffic outgoing to the internet?
What should I do to raspberry to secure it besides opening only required ports?