Help with discriminating wifi AP traffic please

First - is your firewall router a Netgear product? Second - if you configure the M4100 ports that connect to the firewall router to pass tagged packets, then the firewall router must know how to interpret the tags - conversely - if you're not passing tagged packets (and there is no need to since you have two links between the router and the switch, one for each VLAN), then the router should not be configured to do so - in other words both must match. You need to decide what device you want to use for DHCP and configure it accordingly, and also what device you will use for interVLAN routing - you apparently can do it in the router or the switch - the router might be the best place as the switch will not allow you to NAT the traffic (I'm assuming you're sharing a single WAN ip address).