Hermetry doesn’t care, it only sees a TLS connection on 8883 (or HTTPS on 443). Ethernet or WiFi is invisible to it.

For one board I’d get an Olimex ESP32-POE-ISO. I have three in a greenhouse. Isolated PoE, Ethernet on board, works with the normal ESP32 Arduino core. On ESP32 the Ethernet goes through the same network stack as WiFi, so WiFiClientSecure and PubSubClient work unchanged:

#include <ETH.h>
#include <WiFiClientSecure.h>
#include <PubSubClient.h>

WiFiClientSecure net;
PubSubClient mqtt(net);

void setup() {
  ETH.begin();                         // ESP32-POE-ISO defaults
  while (!ETH.linkUp()) delay(200);
  net.setCACert(ROOT_CA);              // public CA, broker host has a public cert
  mqtt.setServer(BROKER_HOST, 8883);   // host NAME, not IP (SNI)
}

void loop() {
  if (!mqtt.connected()) mqtt.connect("barn-01", ACCESS_TOKEN, NULL);
  mqtt.loop();
  // every 60 s:
  // mqtt.publish("v1/telemetry", "{"temperature":7.4,"humidity":81}");
}

Token is the username, password empty. PubSubClient only publishes QoS 0, which Hermetry accepts. Steps for the token are in Connect your first device.

And on the non-ISO version don’t power it from USB and PoE at the same time, I lost a laptop USB port that way.