There’s a way to make this work by enabling UDP on port 9003 to traverse the vlans (see the wonderful work done on the thread below), but it’s not for the faint of heart. You don’t sound faint of heart, so may be worth it for you. Not for me - I use UniFi remote config app to close down the ARC port when I’m not using it for a while, and deal with the security risk the rest of the time.
Here’s what it’d take.
I should mention that I am still pursuing this solution for a different purpose… I’m trying to create a site-to-site vpn so I can run two homes from a single core, though I have relatively low expectations that it will work flawlessly given how network sensitive Roon is. But I’m stubborn, and I hate having two cores and the resulting backup/restore mayhem. But for ARC since there’s a simpler solution I deal with it. Perhaps inconsistent, just want you to know why I’m active on that thread.