The diagram pretty much nails it; with the exception of the CAT between NAS and switch; you really don't need that since your intention is to secure the NAS away from the internet and rest of your LAN. The major DSM updates can be pushed from a computer accessing the NAS via browser, in this case Safari running on the Mac Studio that can upload the update file you download in macOS. The software packages though may be a bit harder to get updated manually.Thanks for that tip on the NAS 10GbE card. I'm now looking at the Synology DS1522+ that has a 10GbE optional upgrade. The way you are connecting the Studio to the NAS and Studio to the Internet and NAS to the router or switch is exactly what I'd like for my setup. I put together this diagram which includes notes contributed by members in this forum. I also added a NVMe M.2 SSD that I can pull out from my Mac Pro and pop into an enclosure for fast external storage. I can probably add more notes, but want to put this out there for critiques.
View attachment 2106531
p.s. I can't figure out how to delete the thumbnails below. They're the same as the above.
Alternatively you can leave this CAT cable attached, but do some steps in both the NAS and the router side to limit the NAS's access in and out of the "firewall". In DSM you can disable the gateway so the NAS does not know which IP is even on the edge connecting to the outside world. And on the router you can do MAC address specific blocking etc.
Anyway as with everything network related, the possibilities are endless, but of course more things can go wrong as well.