I will assume the reference to Ubiquiti was the Unifi Access points and not router (either edgemax edgerouter, or unifi usg, or unifi udm).
At home I use an Ubiquiti ER-X as my home router and UAP-AC-LR access points.
In “lab” I have another ER-X and hEX S (new).
The ER-X and hEX S are very similar, but to get good vlan performance (at least using the “bridge” configuration) with the hEX S, you will need to run v7.1 or above. I am using the latest testing branch 7.2rc4 on the hEX S RB760iGS.
To adopt the UAP, it will have to be connected to an untagged network. Once adopted, it is possible to set the AP to use a tagged vlan for management, but I am not as adverse to what @404Networks refers to as “weird duck”, and what MikroTik refers to as “hybrid” and what Cisco refers to as a Trunk with native vlan as many MikroTik forum members. The IEEE 802.1Q spec requires that every port have a PVID, so the switch knows what to do when an untagged frame is received. It also states that bridges can limit what framing types to accept, so untagged can be ignored. The point being, what MikroTik calls Hybrid are quite common. “Pure Tagged” trunks prevent vlan mismatches, and they also carry priority information, so from a “best practice” point of view, having everything explicitly tagged makes things on trunk ports unambiguous. It also protects against accidental vlan mixing when someone plugs a trunk cable into to wrong port. But you need to understand what an untagged vlan on a trunk port is, because you will encounter them in the field.
At home I use untagged for my trusted/management and tagged for the guest/iot on cables going to the access points.
See this thread 2 ways to associate bridge and VLAN and this post for a setup I was using in my lab just to play with vlans. In that configuration, ether4 is configured as a hybrid port with pvid 10 (untagged,native) and tagged vlan 241.
There aren’t any fancy firewalls in my config, this was just for the vlan setup that I was trying to wrap my head around. Most of my vlan experience is from EdgeRouters which was based on vyatta, which was forked into at least three branches, EdgeOS, VyOS, and DanOS. The way vyatta handles vlans is more like cisco, i.e. it is port centric, and you configure the vlans that the port is a member of, and which one (if any) of the vlans will be untagged on that port (Cisco calls this the native vlan). MikroTik bridge setup is vlan centric, for every vlan, you define what ports will be will be tagged or untagged on the port. (the port/vlan matrix is rotated 90 degrees). As a learning exercise, I created this post.
You may also want to see this thread Bridge VLANS hEX S v7.2rc4 /interface bridge vlan print, because I was confused by winbox not displaying the vlans associated with a bridge-port. The configured ports wont show up in /interface bridge vlan print unless the port is active (has link up). If you use /interface bridge vlan print detail, then it will print at least the non-dynamic entries.
If you plan to use the new vlan-filtering bridge method, I found the resources in this post to be helpful. There is also NEW USER PATHWAY TO CONFIG SUCCESS compiled by @anav that has other good starting points for many things.
This blog post would be helpful to someone wanting to migrate from an ER-X to a hEX S (although it uses old firmware that doesn’t support hardware offloading). I haven’t tried the setup, but it does look intersting, so I am mentioning it, since you said Ubiquiti. VyOS and Mikrotik – VLAN-a-rama