@tuckerm 

I assume you've configured both LAN subnets on the ER605 and assigned then to VLAN1 and VLAN10 respectively?  I also assume the ER605 is the DHCP server for those subnets and not the switch?

You don't need two wires from the switch, you can configure the router port to have PVID=1 (native untagged VLAN of 1) and also belong to VLAN10 but tagged.  You configure the same on the 2428 switch, and then a single cable will connect both VLANs into the router.  Traffic will remain isolated.

The LAN subnet which is tagged as VLAN10 can just be configured as a GUEST network...this prevents it from accessing all other private IPs (so other peers or services locally, as well as the whole of VLAN1).  Basically a Guest can only get to internet.

Now that said, I think the issue may be the Port Profile you have configured on ER605port3.  If it doesn't match the tag/untag you configured on the switch, it won't work.  At a minimum it needs to be VLAN10 tagged.

  @tuckerm 

If all the other VLAN1 ports are behaving as expected, then I think it's behaving exactly as it should! 

What you do next is configure one or more VLAN10 access port(s) on your switch, say make port 3 to be VLAN10 untagged only (no VLAN1).  Jack your test laptop into that, and you should get a VLAN10 IP assigned.  The reason it doesn't work on the router is it's expecting VLAN10 traffic to be tagged, and by default, most laptops are NOT.