I think the problem at hand is that ROCK will not deliver you a DHCP address – it does not run a DHCP server.
The br0 thing you are doing actually is completely counter to the entire idea you are trying to protect against… the br0 bridger makes EVERY packet on one side end up on the other side, and vice versa.
My understanding was that you wanted to protect against all traffic/noise on one side making it into the other side.
Assuming you are ok with the fact that the NUC itself is not good at isolating EMI, the best way to do that is with 2 subnets the way I’m describing, but you need to be able to setup your SOTM device to have a static ip.