Home network - layout 'best practice'

I am looking for some advice on the 'best practice' wrt home network layout.
I have enclosed a diagram showing my current layout.

As you can see from the diagram, my Sophos router is connected to the internet via the modem on one network card, and to the internal network on another card. The switch is a managed device,(although I don't use it as such) and this connects to a couple of computers,printer nas etc, and to two old routers set as APs. One AP just accepts wireless connections, and the other both wired (tv and set top box) and wireless connections.
My internal addresses are in the range 192.168.1.*, with most wired devices having a static ip. DHCP is set up to issue IPs in the range 192.168.1.41 - 50 for wireless devices. The switch, and two router/aps have static IPs.

So at the moment with my set up, Sophos only controls traffic to and from the internet, and does not handle traffic internally between devices. This concerns me (should it ?) as I feel that the UTM should also manage the internal traffic for extra security (am I being paranoid).

So I'm thinking that I should make use of the managed switch and create VLANS. I suppose I would have to change the routers/aps? as they won't handle VLAN tags.

What do people think ?

Any advice/help would be much appreciated.

Many thanks
Mike