Multiple port tagging

Hello,

I have a complicated question so please bare with me for a moment.

I have an ESXi 6.5 host that is running a virtual Sophos UTM 9.4 appliance. I also have a Netgear GS108Ev3 managed switch. I also have some other virtual and physical devices that they don't matter at this moment.

I created a virtual network on ESXi and tagged it with VLAN2.

I created two virtual networks on UTM, both connected to the aforementioned virtual network. One has tag VLAN2, the other does not.

I have enabled VLAN 802.1Q on the GS108Ev3. ESXi gets Untagged, the other physical devices they get Tagged.

The virtual machines attached to the virtual network, are able to communicate with each other no problem.

I left PVID on 1

Problem 1:

I cannot get the physical devices that are on VLAN2 tagged on the switch to communicate with the firewall, but they can communicate with each other

Problem 2 (more or less expected):

From the virtual network that has VLAN2 tagged and also tagged on UTM, i cannot communicate with anything.

I am pretty sure i am doing something wrong but i cannot grasp to what. I was wondering if you guys can think how to fix it.