Adolf Belka is correct, when it comes to segregated networks you generally only have one vlan per network regardless if it is ipfire or not, in this case ipfire’s zones are an independent network and so each zone can only have 1 vlan.
Is your switch a managed or unmanaged one? If it is managed you can easily configure the ports to handel the vlan tagging, on top of that like Adolf said assign blue and green with different vlan tags on the same nic, for example my network I have a 48port managed switch with port 1 vlan10 tagged to go to the fiber ont, port 2 vlan 10 untagged going to the Wan port of ipfire, ports 3-36 vlan 20 untagged (green),ports 37- 42 vlan 30 untagged blue, and then 43-48 vlan 40 untagged orange,
Native actually means vlan1
The difference between tagged and untagged is that tagged means that the device plugged into that port must send and receive the correct vlan ID, where as untagged means it will accept all incoming packets and it will Untag any outgoing packets, but inside the switch for example all the packets are treated as tagged.
so If your switch was a managed switch the I would set say port 1 to vlan 26 tagged and vlan 26 tagged and set the associated green, blue to these and then port 2-24, if it is unmanaged then it can be a little different because most unmanaged switches don’t support vlan tagging and can be hit or miss on how the packets go, If all of the things plugged into an unmanaged switch are on the same vlan you won’t have an issue but when it comes to multiple vlans on a switch it should be a managed switch
Are you able to advise me on the model number of your switch is?