Thanks for the suggestion regarding the router, I didn't think about virtualising it.
In terms of this type of configuration, yes, any private NICs on the host are connected to a switch. In the simplest setup, I can provision Harvester nodes using only their private interfaces, but then there's no internet connectivity, hence a separate router in the first attempt, as without it, I'd be essentially doing an air-gapped install
Having separate public NICs may not be optimal in this situation, but I don't think it's unusual as part of standard offerings by bare-metal providers, (in this case, OVH), as it allows a simple way to sell individual servers with x amount of allocated internet bandwidth and x amount of private bandwidth.