S/MIME ACME using RFC8823

That's right, according to Chrome:

...priority is given to ... CAs whose certificates and certificate hierarchy are only used to issue TLS server certificates, and do not issue other forms of certificates.

Mozilla also has a similar recommendation, though not worded as strongly:

We also recommend that CAs consider using separate root CA certificates with separate public keys (or separate intermediate CA certificates with separate public keys under a single root) when issuing certificates according to different Certificate Policies, so that we or others may selectively enable or disable acceptance of certificates issued according to a particular policy, or may otherwise treat such certificates differently (e.g., in our products' user interfaces).

Microsoft only has requirements on separate intermediates:

Issuing CA certificates that chain to a participating Root CA must separate Server Authentication, S/MIME, Code Signing, and Time Stamping uses. This means that a single Issuing CA must not combine server authentication with S/MIME, code signing or time stamping EKU. A separate intermediate must be used for each use case.