At this point, without a switch, the only way forward I can see this going is as follows, besides leaving everything as it is:

Scrap that for now, we’ll come back to it once you buy a managed switch. Let me know if you need a more detailed explanation, or if you got the gist of it and can manage. You can create a trunk, so that you get all the vlans on the switch on proxmox as well and you can assign VMs to vlans where proxmox does not have an IP address. What I would do is give port 2 back to proxmox and only use ports 3 to 6 in pfSense.

Or you enable the Proxmox firewall, so you block access to it from the VMs, but then you have to maintain 2 firewalls. However, that is going to allow VMs to access Proxmox too, which you probably do not want. In VMs, you can also bridge their virtual interfaces to that proxmox bridge, so they can also get IP addresses from pfSense and you will have a completely segmented network for proxmox. Proxmox will then grab a DHCP address via that bridge if you enable DHCP on that bridge in /etc/network/interfaces. Then in pfSense, you make a new subnet, assign an IP on the virtual interface in pfSense, it should show up as OPT5 or OPT6 and you enable DHCP on it. You can create a new bridge and bridge it to a virtual interface that you add to the pfSense VM. I cannot seem to grasp how to achieve the same secure, segmented network with EVERYTHING going through pfSense while using direct PCI passthrough AND no other physical hardware switches in the mix. Nearly all of the guides and examples online use virtual linux bridges in ProxMox with bonded ports. without being exposed to the open internet or going un-filtered.

What I cannot seem to understand / figure out is how to connect ProxMox to the internet through pfSense so ProxMox can still get updates and access time servers, etc. I have NICs 2 thru 6 passed through directly to pfSense via PCI. NIC 1 is an offline management port (NOT passed through to pfSense) with a statically mapped ip address so I can access ProxMox (via ethernet cable plugged directly from my laptop to NIC 1) when I screw something up. I have a cable modem providing WAN via DHCP to my ProxMox / pfSense box with 6 onboard NICs at the front of my network.

Pfsense proxmox