What you really want to do at the Incus level is:
incus config device add MY-INSTANCE eth0 nic nictype=bridged parent=vlans vlan=10 name=eth0
Assuming a physical interface named vlans with 10 in the vlan_ids.
We do allow roles on VLAN devices, but there’s basically no reason to ever put the instances role on one of those as that would then make Incus use macvlan on top of that device, just adding overhead where it’s not needed.