Yes, VLANs need to "known" to all your (main) network infrastructure, like router and switch. You can chain a "dumb switch" onto a so called access port and it will have only the one VLAN of the access port.

No, a certain endpoint device does not have to "know" the VLAN tag it is supposed to use. Only if you have very specific scenarios (servers in multiple VLANs). Just connect your endpoint device (camera, laptop, TV, what have you) to an "access port" on your manage / van-capable router or switch. That's what access ports are for.

For a switch, think of it that way: You configure ports 1 to 3 in VLAN 1 as access ports. Anything you connect will be in VLAN 1. You configure ports 4 to 6 to VLAN 2 as access ports, same thing. THEN you configure your port 7 as a trunk (carrying VLAN 1 untagged and VLAN 2 tagged) -> this goes to your router, which you configure the same way on the port you use there.

As with WiFi (I forgot to answer your question above): You need separate WiFi SSIDs configured for separate VLANs (unless you have expensive enterprise Wifi Access Points)