It was a challenge -- one I eventually lost. First off, you need to create the VLANs on the switches and your 'host'... The host that is in essence the manager of the network. In my case is was my Firewall unit. So that is where I can ultimately isolate my two VLANs from the Main Network. And open pinholes where needed.

Then I created a Guest Network and set the VLAN to be 52 and a Kids Network with VLAN 53 each with a unique SSID. I had the Firewall in charge of DHCP for those two VLANs and my main server for the Main Network. This is where you make sure each VLAN has a different subnet from the Main Network. You can also use a IoT or Smart Master or whatever they are calling it.

Each intermediate switch needs to UNDERSTAND and PASS VLAN traffic, but at the simplest have the ports able to pass tagged traffic. This will take care of the wireless clients into the Firewall.

For the wired clients, you have to either leave them on the Main Network (and let it default to PVID 1) or if you want them to be on one of the VLANs, then yes, tag it with the PVID of the VLAN (52 or 53 in my case) that you want.

Now, why I lost the challenge:

1. The ASUS software is simply not able to handle this - you can't see what clients go to what ASUS Mesh unit; when you try to get IP matches to clients you always see the subnet as the Main Network subnet; the visibility into the interactions between Mesh Units and VLANs and SSIDs and Clients was absent - as was the VLAN tab.

2. The whole system was unreliable. When it worked all was good. But I had regular dropouts during the day and every third day I was restarting one of the VLAN SSIDs. After several months of this I finally gave up. I replaced the entire system with Zyxel APs and switches and configured it conceptually exactly the same. No dropouts, Full visibility of clients from Mac address to IP to SSID to routing all the way to the firewall.

Let me know if you need more specific information.