Using the second router would be your easiest option. Steve Gibson talked about this on Security Now on Episode 544. Here is a TWiT Bit on the topic: https://youtu.be/vntacaj7gy8
Me personally, I use a Ubiquiti EdgeRouter and Unifi AP with two separate SSIDs, one for my personal devices, and one for my IoT devices. Although this takes a bit more advanced setup than adding a second router under your primary, it also gives you more control over the devices that are on your network. For example, there are some IoT devices that need to be accessible from your personal device, like a Google Chromecast. Using the two-router setup, you will not be able to access it from your personal network through the second router. With a more advanced setup, you can isolate it so that it cannot access anything on your personal network, but still make it accessible from your personal network.
It really depends on what kind of IoT devices you are using, and what your technical capabilities are, which setup will work best for you. Hope this helps.