Any VLAN # that isn't in use. Disable DHCP on it. Assign it to the POE LAN port. Isolate from any forwarding on the MX.

You can run a full stack behind the MG, or you can run the MG as an independent 5G gateway - up to you based on the architecture of your site. Keep in mind bandwidth varies by carrier, by region, by time of day even.

No, do it via dashboard https://documentation.meraki.com/MX/Networks_and_Routing/Configuring_VLANs_on_the_MX_Security_Appliance

Basically isolating the POE LAN port from traffic forwarding to serve as power only.

Is that connection to the Rete Test Plant MPLS or L2? Have you seen this? https://documentation.meraki.com/MX/Networks_and_Routing/Integrating_an_MPLS_Connection_on_the_MX_LAN