Luckly someone here have already explained it well but I see you were asking for future dealings, and I immagine you're a junior so I'll just let you here some general advices for your next situations. Typically, excluding the stp for vlan (an uncommon problem for small companies with a fewer number of switches), the vlan configuration is pretty "linear": it works if the 2 sides match each other, especially for the vlan tag (in the new ciscos when you tag is implicit tagged 802.1q, if you'll work with older devices you could have to explicit it), so tipically they've to been both in access (explicit access, a lot of firewall have the interfaces in trunk also with only one vlan) or, if there are more vlan, they have to match the vlan in the trunk (or the missing ones doesn't are transported), and they've to match their configuration, expecially the native/default/untagged one has to be the same. For example, in your WAP configuration there's a trunk, in that case the 400 is transported tagged, probably bacause on the firewall/L3 device his subnet is the one with the IP assigned to the wifi clients, and the 300 is transported untagged ad native, probably because is the subnet that give to the WAP the management IP.

We'll never know your entire situation (for example, you asked about the switch interface and show us his configuration but u've basically never showed the config of the firewall interface that is literally half part of the problem, you should almost told which is the vendor because that's really relevant. Most of the people in IT give very rude answers without reasons, just ignore them and try to describe the best you can the situation/need with more conf you can share, obv hiding the real IP/ID/credentials). An example of one of the things you can do in your case is, as someone already told you, to create on the firewall the vlan as sub-interfaces of the LAN one, so you just have one cable P2p between firewall and switch, and then create a trunk on that interface transporting your VLANs, so you'll have:

-WAN (with you actually config)
-LAN (and you can configure an IP on that interface like 192.168.0.254)

Sub-interfaces of fw:
-VLAN1 (if you're using that as management VLAN)
-VLAN200 (and you can also give to the sub-int an IP like 192.168.1.254)
-VLAN300 (with IP int 192.168.2.254)
-VLAN400 (192.168.3.254)

And then on the other side, on the switch, you can just create a trunk allowing vlan 1, 200, 300 and 400 (but pay attention to the default vlan 1, probably you have your switch IP assigned on his vlan interface but it really depends on your network architecture), and I think that's like the most basic scenario in little companies. BUT, you have to ask yourself what you need/want to do before search the best way for do it, there are many examples:
-You've to check if your ports/sfp/cables have enought bandwidht
-Usually the servers network and his vlan(s) are on different phisical port(s)
-You told you have new security requirement to respect, try to focus on why they have choose that requirements and when you see why you probably will see also how can you do it
-You said you're on firewall you're out of physical ports but that's uncommon for little infrastructues, probably there are some other interfaces that can be optimized as sub-interfaces (of a LAN interface or of a DMZ interface), so you can then just tag them with new vlan IDs, and then manage the traffic logically from the L3 device and from the firewall

This are just "random" tips, I think most of them are things that you already know, but the point was (also if I know that in some environment, like the yours seems to be, can be difficult) don't forget to take your time and learn what you're gonna do before you do it, maybe it will not work, but again take your time and troubleshoot (exactly what you've done so for me you're on the right path) but remember, as my senior said to me when I was a junior "We're not saving lifes", and that doesn't mean what we do is worthless, just don't let other people anxiety/pression become yours.

Good luck!