It does not quite work like that.  Officially, the MTU is the size of the data (payload) in an IP packet.  It does not include the headers or checksums.  However, the name MTU is also slightly misused for other things in routers, in this case for the size of the payload of the Ethernet frames.

The IP protocol does not do VLANs, that is part of the Ethernet protocol.  So the VLAN headers, when used, are added to the existing Ethernet headers, and are not part of the Ethernet payload, let alone the IP payload, so are not counted in the MTU value.  You can have multiple VLANs embedded in each other and so have multiple VLAN headers added to the Ethernet headers.  That is all handled automatically by the Ethernet drivers, not the TCP/IP stack.  So the MTU values do not need to be adjusted to account for the use of VLANs (or not).

The payload part of the Ethernet frames is where the IP packets are send, encapsulated inside the Ethernet frames.  So the full length of the IP packets is all data to the Ethernet frames.  The size of the Ethernet payload needs to be set in a router, and an "MTU" value is normally used for this.  But the MTU setting here specifies the data size of the IP packets, not including the IP headers and checksums.  The router adds the standard size of the IP headers to the MTU setting it has been given and uses that calculated value as the actual payload size for the Ethernet frames.

PPPoE is part of the IP protocols, and its headers are in the IP packet, inside the Ethernet frame's payload.  When you configure an Ethernet port in a router, that port only calculates its frame size from the given MTU value on the assumption that it will be having IP packets in the payload.  If you configure the payload to be PPPoE, then there are another 8 bytes of PPP headers added to the payload that the router does not put into its calculation.  So you need to increase the MTU value by 8 to account for that.

So the result is that these settings should be used:

1) When not using PPPoE:

Set the router's Ethernet WAN port MTU to 1500 (the default MTU for IP packets on Ethernet).

If using VLAN 10, set the VLAN 10 MTU to 1500.

2) When using PPPoE and your ISP and fibre provider have overprovisioning in place to allow for the extra 8 bytes of PPP headers (as is the case everywhere in NZ as far as I know, for fibre and VDSL):

Set the router's Ethernet WAN port MTU to 1508.

If using VLAN 10, set the VLAN 10 MTU to 1508.

Set the PPPoE MTU to 1500.

3) When using PPPoE and your ISP or fibre provider does not do overprovisioning, or your router does not support MTUs greater than 1500:

Set the router Ethernet WAN port MTU to 1500.

Set the VLAN 10 port MTU to 1500.

Set the PPPoE MTU to 1492.

If using IPv6, set the router to put an MTU of 1492 in its Router Advertisement (RA) packets.  Failing to do this or some other such workaround will result in IPv6 being broken as IPv6 packets in the MTU 1493-1500 range will be silently dropped when attempting to pass through the PPP connection in either direction.  This is due to the long-standing PPP software bug that it does not send ICMPv6 packets when it drops IPv6 packets, contrary to the requirements of IPv6.