Got this, for me and your setup seems similar enough, I prefer stub-vlan/dedicated setups for each type of stg traffic.
EX: My config
LAN - vlan 10 (routed/firewalld)
MGMT - vlan 11 (routed/firewalld)
VMOTION - vlan 12 (stub vlan/no routing/gw)
NFS - vlan 13 (stub vlan/no routing/gw)
iSCSI - vlan 14 (stub vlan/no routing/gw)
FT - vlan 15 (stub vlan/no routing/gw)
Then just setup a trunk port from phys switch to phys nic in vSphere, define/tag vlans on appropriate uplinks, create std vSwitch or vDS virtual switches w vlan port groups/port profiles, map to VM's (in your case stg AIO VM w/ vmxnet3 vnics on each network), create vmk's for NFS/iSCSI mounts, create iSCSI initiators, map luns, add datastores.
High level, that will isolate/segregate/dedicate a single broadcast domain for each type of traffic on your lan, focusing in on the IP SAN side of the house here specifically.
:-D
EDIT: Worthy mention may help if I told ya I (or it may be obvious) that I have multiple vnics added to my FreeNAS AIO, one for LAN that is routed/on proper vlan for SMB/NFS/iSCSI shares but the hypervisor traffic is totally isolated.