Every interface should have a correctly configured firewall zone. However, if you want to only use layer 2 and not layer 3 routing on a VLAN (only switching, no traffic between VLANs), you can set the interface as unmanaged (option proto 'none'), in which case do not set a firewall zone for the interface.

Keep in mind, that at least one interface should have an address (static or DHCP) in order to connect to the device for administrative purposes. That interface must be associated with a firewall zone (or rules) to accept input.

Example, where VLAN 1, 2 and 3 are only used for switching and VLAN 1 can be used to connect to the device:

config/network

config device 'switch'
	option name 'switch'
	option type 'bridge'
	option macaddr 'REDACTED'
	list ports 'lan1'
	list ports 'lan2'
	list ports 'lan3'
	list ports 'lan4'

config bridge-vlan 'lan_vlan'
	option device 'switch'
	option vlan '1'
	list ports 'lan1:u*'
	list ports 'lan4:t'

config bridge-vlan
	option device 'switch'
	option vlan '2'
	list ports 'lan1:u*'
	list ports 'lan4:t'

config bridge-vlan
	option device 'switch'
	option vlan '3'
	list ports 'lan3:u*'
	list ports 'lan4:t'

config interface 'lan'
	option proto 'dhcp'
	option device 'switch.1'
	
config interface 'iot'
	option proto 'none'
	option device 'switch.2'

config interface 'guest'
	option proto 'none'
	option device 'switch.3'

config/firewall

config defaults
	option syn_flood '1'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'REJECT'

config zone
	option name 'lan'
	option input 'ACCEPT'
	option output 'ACCEPT'
	option forward 'ACCEPT'
	list network 'lan'