All of your assumptions and logic are correct. lgb0 is indeed the physical interface, and also says something about the driver selected to manage it, as you discovered this often tells you the model of the card (not always - some drivers handle many more than one model, and you would learn the model with other tools, such as dmesg). The physical interface knows nothing about VLANs. It just gives you layer 0 access to a network, in your case gigabit ethernet ovre twisted pair (802.3ab). It is up to the driver and higher layers in the operating system to create and configure virtual VLAN interfaces to be used by your PFSense software.
Your physical example is also good, with one caveat. The switch must be VLAN-aware for all of this to work. An inexpensive switch is most likely NOT going to have this feature. You will need a switch that specifically mentions "Managed". Then you will need to add the VLAN definitions you want to use to this switch, then configure ports on the switch as "trunk" (for the pfsense box) or "access". Trunk ports are generally "tagged", meaning there is information in the ethernet header about the VLAN the packet is destined for. That's good for pfsense, so it will know what virtual interface the packet will be received on!
Access ports are generally NOT tagged, and the port won't even see packets that aren't destined for its associated VLAN.
I realize this question was asked months ago and you probably already have an answer. Perhaps it will help someone else in the future.
