If you have a vlan-capable switch (e.g 2900XL, 3500XL) you can implement a "router-on-a-stick" design.
The idea is to setup sub-interfaces on the router with ISL or dot1q encapsulation on the router, and setup a trunk port on the switch.
As far as performance, the bottleneck would be the router's encryption throughput (I think it is less than 6Mbps for low end routers).
Security wise, you better off using ISL encapsulation on sub-interfaces.
HTH,
Mustafa