"The reason I am accessing iSCSI storage from within the guest OS is because I need to mount a cloned snapshot volume to recover data."
Are not able to mount this snap directly to the ESX host and then browse the newly mounted VMFS and retrieve what it is your looking for? I have a similar process and that's what I do when I need to restore a VM or perform a file level restore. Once the restore is done, we just unmount the snap and rescan all storage adapters.
"The part I am not familiar with is how to get a portgroup tagged to my vSwitch. I have the standard VM Network vSwitch 0. Do I need to add another NIC?"
How are VLANS being advertised to the ESX host from the switch? Trunk or access mode? If it is trunked, then you need to find out what VLAN ID is dedicated for iSCSI. If it is access, then you would NOT specify a VLAN ID on the portgroup dedicated for iSCSI.
On the ESX side, I'm assuming you are using virtual switch tagging so therefore as long as you know what the VLAN ID is you would then used the same VLAN ID/Number for the portgroup dedicated to iSCSI.
Can you share what your topology looks like and include all NICs and switches?
Here's the official doc on this.
Sample configuration of virtual switch VLAN tagging (VST Mode) (1004074) | VMware KB