Okay your wording is very confusing, but lets see if we have a common understanding.
The hapac2 needs only to be acting as an AP/switch. It simply needs to have a trunk port from the AX3 carrying the necessary vlans to distribute traffic to dumb devices (pcs, printers etc) and smart devices (like switches that can read vlans). It does not create its own subnets.
The AX3 is connected to the internet and on port is connected ( trunk port ) to the hapac and this cable carries all the vlans. One of the vlans should be the TRUSTED or MANAGEMENT vlan. This is the only vlan we need to identify on the hapac.
/interface vlan
add interface=bridge name=vlan11-TRUSTED vlan-id=11
/ip address
add address=192.168.1.2/24 interface=vlan11-TRUSTED network=192.168.1.0
Then its normal vlan filtering aka pcunites article, look for ap/switch example.
A router acting like a switch is identical to this switch example for the most part.
https://www.youtube.com/watch?v=YLtGQAQ8iS0&t=1366s&pp=ygUNd2lsbWVyIENSUzMyNg%3D%3D
THe key takeaways are
On /interface bridge vlans, only the vlan-id=11 (TRUSTED vlan) has the bridge tagged, the rest of the vlans come in ether1 (tagged) and go out their respective ports either tagged or untagged depending what device they are going to.