network infrastructure setup

[privacymost]

Freshman Alert!

I am new to the opnsense. very new... here are some questions need to be clarified before moving on:
-for the network infrastructure, can opnsense router (with wifi, AV, VPN) be a standalone router for the entire home? or it has to be modem->opnsense firewall->brand router? or modem->opnsense router is fine. I wanted to build a secured & private network that can prevent being tracked or monitored 99% if that can be.
-How to safely set up opnsense without using ISP network, or can set it up offline? setup includes detailed IDS/IPS, advanced DNS settings etc.
-for hardware recommendation, I need the fast speed, AES-NI with wifi 2.4ghz & 5.0ghz. I had browsed several kinds of mini pc soft router but still hard to choose a good one. Please advise...
- To be able to reach good speed & VPN protect, currently I have express VPN or proton VPN to choose, which one is better? I saw wire guard only comes with Proton and openVPN comes with Expressvpn but could lower the speed. Please advise...
- Is there anywhere I can see a video or step-by-step intro on setting up the most secured & comprehensive DNS with encryption along with the full settings.
Thank you!