Sophos UTM 9.352-6 with some clients using Standard Proxy HTTP(S) 8080 and others using Transparent mode?

Hi All,

I am not sure what I need:

a) 2 Internal VLAN's and 2 UTM's(one red/green the other green)?

b) 2 Internal VLAN's and 2 UTM's(two red/green)? 

c) 1 Internal VLAN and 2 UTM's(one red/green the other green)? 

d) 1 Internal VLAN and 1 UTM(two red/green)?

I would like to use HTTP(S) inspection to make sure the more vulnerable devices stay out of trouble : The windows/mac computers use the system proxy setting 192.168.1.1:8080 for http and https.  I have installed the self signed certificate in the local computers CA store and told Chrome and Firefox to trust that certificate as well. 

I would like to use Transparent mode to reduce my firewall futzing for the less vulnerable devices : I may have Linux machines or other devices(apple tv, ipad, iphone, android phone or tablet, nexus player, nest devices, google cloud print printers) I do not want to mess with Proxy settings, auto config, pac files and the like for some devices.  For these other devices can I have them use the UTM in transparent.  In transparent mode can I block all and do some sort of whitelist web browsing

I manage two UTM 9.3 Firewall/Gateway/Router/NAT/Transparent Proxy for a cable modem ISP home use connection.  One at my home and the other at my parents.

I assume if the UTM is in Transparent mode port 8080 is NOT listening.  I assume once I go Transparent mode I cannot put a deny entry for the NAT or Firewall as this would block the SQUID proxy from passing traffic to the internet.

Thanks,

Joe