I have discovered the vconfig command which allows me to add vlans without having to restart networking, which is nice. How do I make the vlan be "up" but without any IP? I want it to be usable to bridge VMs to, but I don't want the host itself to be able to communicate in/out on these vlans. I only have one vlan which is the main one, and that one is configured in the interfaces file. Issue with using that file is I find you have to reboot sometimes for changes to work. In fact even having to restart networking is not really acceptable as this will be production.

Basically I want it to be up at the layer 2 level, but that's it.

You don't have a choice,. VLANS are always layer 2.

What does your interfaces file look like?

Ended up going with ESXi so I'll mark this as solved. Iface file was fairly standard, just a bonded connection trunk port with 1 vlan configured.