How organize ISP connection with the best safety?

I need to deside how connect ISP in the organization. Right now ISP are connecting by cheap router and unmanaged switch.

I bought mikrotik crs328-4c-20s-4s+rm and new server which I must connect and separate network by VLAN.

I have 3 ideas:

1. Buy one more Mikrotik just for connecting. And separate network by VLAN on it. Mikrotik crs328 with SwOS.
2. One more Mikrotik, but split network into VLAN on Mikrotik crs328 with RouterOS.
3. Connect ISP to Mikrotik crs328-4c-20s-4s+rm with RouterOS

How organize connection with the best safety? Or maybe you can offer other decision and literature.

How such organized in the enterprise networking?