Laravel by default is already split for you. Just looking at the routes directory you can see there are separate files for web routes and api routes, prefixed with api, though you can change the prefix yourself.
The part you will have to actually think the most is the Dashboard/Website part, where you will have to implement authorization to know who can access what.
Basically, you are just building a normal application, then you start adding different controllers that would respond to API routes since application controllers and api controllers do not return the same thing. Application controllers return mostly views and redirect, whereas api controllers return mostly JSON formatted data. You can split those controllers into 2 different directories like this
app/Http/controllers/web/
app/Http/controllers/api/
So when generating controllers in artisan you prepend the directory
php artisan make:controller web/DashboardController
php artisan make:controller api/UserController
And so on.
So to summarise:
1- API: use routes/api.php, controllers return JSON return response()->json($data);
2- Common: Some helpers, services & middlewares shared by web & api
3- Dashboard: Authentication + Authorization to limit access. Use a routes group here and apply middlewares
Route::group(['prefix' => 'admin', 'middleware' => ['auth', 'admin']], function(){
//admin routes go in here
});
4- Web: Public data, read only. Not authorization require. Just basic pages with no authentication.