Guest network isolation

Not sure about what exactly you’re asking with regard to hAPs, but I’d go with the bridge VLAN … even though hAPs don’t offload that to hardware, it probably doesn’t matter much if hAPs won’t be used as switches between their ethernet ports (HW offload doesn’t help much with traffic via wifi as that’s handled by CPU anyway).

I’m sure you already read this excelent vlan tutorial, but if you didn’t, do do. It explains how it should be done.