Trying to learn some advanced networking

Evening all,

I’m doing some learning with layer 3 switches to expand my functional knowledge and I’m hoping to get some advice from more experienced minds.

I’m trying to get away from a router on a stick configuration for my home lab. I’ve been running into an issue in the fact that I would also like to apply an ACL to some vlans as added security. I have a general network VLAN (10) and a internet of things devices subnet (20). For control of the IoT devices I would like to reach them from my general network but I do not want those devices to be able to reach my general network unsolicited.

My questions are as follows: Is this possible with just an L3 switch? If not is there a recommended way to implement this that keeps as little load on the uplink to the router?

Ideally things would only hit the router if they are bound for the outside.

Thanks