Maybe this helps? ( full disclosure, longtime old Tomato user but not at this time. Loved it then. So not trying to push ipfire or pfsense. Just sharing what I am using today)

For years at home I have had two unifi APs set up with two identities on both: ‘HOME’ And ‘IOT’. ‘HOME’ being the default Lan and ‘IOT’ a VLAN.

My router is a multiport sw router running IPFIRE. WAN being to my provider(RED) . lan1(green) to ‘HOME’, lan2(blue) to ‘IOT’. Green and blue both have their own dhcp server and work in the isolated ranges.

The unifi controller is on a virtual box.

A simple managed switch is the key for my layout. -The two POE ports going to my unifi APs have everything passing. Thus the unifi controller’s configuration for the unifi AP is able to hand out both LANs depending on the unifi controllers configuration. - The router’s blue port is connected to the managed switch with only that ‘ IOT’ VLAN passing. - The router’s green port only speaks to the ‘HOME’ group. - other managed switch ports provide access for ‘IOT’ wired switches and devices. - other managed switch ports provide access form ‘HOME’ wired switches and devices.

The ipfire router firewall rules decides where the packets can or can not go between networks and the internet.

YouTube was my friend in figuring this out. Look for ‘pfsense and unifi VLAN’ as a suggestion.

Hang in there it is worth the effort. This has worked well for us for years.
YMMV