WAX630 - two SSIDs, one bridged, the other NATed

Guess there is some big misunderstanding.

This WAX630 is connected to a wired network, so the SSID1 is supposed to work like a normal AP (technically indeed a bridge from the radio to the wired network). A WiFi bridge configuration would create a WDS (Wireless Distribution System) where a WAX6xx would run without a wired Ethernet connection to the primary network, the uplink to the wired LAN is established over a wireless connection, forming a WDS from the WAX6xx satellite or extender over a a WDS to a WAX6xx root AP which is connected direct to the Ethernet LAN. Note: The Wireless Bridge (WDS) configuration is documented in the fine documentation Insight Managed WiFi 6 AX6000 Tri-band Multi-Gig Access Point Model WAX630 User Manual p.206 ff. under "Set up a WiFi bridge between access points". Doubt this is what you are behind.

A SSID for a WAX630 operating as plain access point is shown in the find documentation starting from p.53, "Set up an open or secure WiFi network". I guess this is what you want to do with the SSID1. yet another simple AP config.

Indeed, the URL Filter is active WAX6xx system-wide, not imited to just select SSID and/or VLAN.