…this is the first thing you should read: http://forum.mikrotik.com/t/using-routeros-to-vlan-your-network/126489/1 and understand.
The basic, logic/concept applies to all hardware, not only MT devices based on RouterOS.
Are your L2 Switches and APs VLAN capable?
Especially, when running separate Wifi-Networks/SSIDs on the same, single wired connected AP, using tagged VLANs are a must requirement.
Then, start to think about the layout of your future network based on VLANs, independent of software capabilities and settings.
You’ll want individual VLANs for each distinctive network you want to manage/use.
Then go from there and configure each component, VLAN for VLAN.
Do not forget to create a separate Management VLAN.
Fokus on getting connectivity first. Only after that, configure the RB4011 firewall to create the desired separations (Guest, IoT, reachable from LAN only, …)
Do not worry about the VLAN features or lack thereof in the Switch-Chip of the RB4011, its CPU will compensate for that with ease.