CAPS-MAN based forwarding: traffic stops. Loops/Spanning trees?

Hello,

I have 6.41 running on a newly created CAPSMAN based wifi controller:

/interface bridge
add fast-forward=no name=bridge1protocol-mode=none

From Radius, different clients get different VLAN IDs (10, 20) and can happily connect to plus anotherone for an SSID with Preshared Key

/caps-man datapath
add bridge=bridge1 client-to-client-forwarding=no
local-forwarding=no name=datapath1 vlan-mode=use-tag
add bridge=bridge1 client-to-client-forwarding=no
local-forwarding=no name=datapath2 vlan-id=30
vlan-mode=use-tag

Sometimes, users are connected to wifi, they have an IP address but cannot longer use internet. I am asking myself, whether the problem is that bridge for all of those users? How should I set STP on bridges? How can I deny inter vlan layer 2 traffic? (It´s a bridge, right?) I set protocol-mode=none on the bridge. Is that right? How do you filter e.g. STP packets/or loops on the CAP itself? How can there actually be a loop coming from the CAP at all?

Update: Found that strange entry within “Ports” on several CAPs. Bridge itself says “none”