Is subnetting or VLANs the better option to separate the networks? I've read a lot on both lately but can't decide on what would be best for this scenario.
Subnets is logical division of networks. It works on layer 3; different IP networks cannot communicate directly with eachother, but must go through a router.
You can have multiple subnets in use on the same physical segment if you want.
VLAN's is physical separation. It splits the network at the Layer 2 level, so no packets can flow from VLAN 1 to VLAN 2, without some device that sits in both VLANs.
Very often a combination is appropriate, where a subnet matches a vlan, so that you have a 1:1-mapping between subnets and physical broadcast domains, but this is not a technical requirement.
Is VPN the most secure way for a client to access the server network, or would allowing it to access both networks all the time be just as secure?
VPN is a technique to transport packets securely over a unsecure network. Nothing more, nothing less. Depending on your threat model, using TLS and the Internet may be secure enough and far easier to deploy.
Does the routers need to have a separate IP from it's parent router or is the gateway IP enough?
???
Do I really need three routers, or would it be enough with just one?
Get a old computer with at least two NIC's. Install pfsense. Get a VLAN capable switch. Start playing. For added learning, add a second computer with pfsense, and set up a third subnet. Add routes between the networks. Deploy a dynamic routing protocol, such as OSPF.
