Yes you got it right, and yes, you'll need a separate, isolated power supply for the isolated side. But you would have needed that as well if you had isolated at the USB level, so this requirement is there however you handle this. Benefit is that in this case, the MCU can be powered from USB, and the isolated power supply will only have a few mA of current to deliver.
There are several ways of implementing this. If you have no available isolated power supply (keep in mind that a dedicated power supply for the isolated side needs to be *isolated* from the USB side, so you can't use just any solution: for instance, many AC adapters are not properly isolated from "earth", and the USB side is usually not either (unless you're for instance strictly plugged in a laptop which is on battery only with AC unplugged), so there you'd break the isolation.
So you either need a properly isolated AC adapter, or you can also power the isolated side from batteries if it's convenient, or you can alternatively (probably best but can be a bit more expensive) use an isolated DC/DC converter to power the isolated side from the USB VBUS. There are many such converters out there, and if you only need a few mA of current, you can find them relatively cheap. Another alternative is to get rid of optocouplers and the DC/DC converter and use a digital isolator such as in the ADuM series with "ISOpower" - those handle the isolation of digital signal and generate an isolated power supply all in a single chip. For instance the ADuM5201 which would be a right fit here. Overkill in terms of bandwidth, but it's only a few bucks and will replace two optocouplers+a, isolated DC/DC converter, so I guess it should be cheaper.