I’d say use the RB5009 as the main router and switch. But all Mikrotik have the same RouterOS, so all support VLANs - some are faster at router and/or switching for sure. But both would work for your purposes. While using router as switch make sense, I’m a big fan of the Wi-Fi being seperate from the router. Why I suggest RB5009 has a smaller footprint, and no internal Wi-Fi which I think is an advantage IMO since separating Wi-Fi out allows for easier upgrades later as those standard evolve - IP routing isn’t changing.
I’d review “Using RouterOS to VLAN your network” here: http://forum.mikrotik.com/t/using-routeros-to-vlan-your-network/126489/1 – offers a “catalog of topologies” you use on either the RB5009 or another Mikrotik.
If you got crazy you could get two routers and use VRRP to make them redundant. Then an RouterOS upgrade, and there are frequent ones, would not cause any outage.
Since the router come with 8 to 10 ports I might not need the switch at this point. Is it a good idea to have the VLANs on the router ports and add a few cheap unmanageable switches later like netgear GS108?
Access point: cAP ac wall mount. I am not sure if it provides me with the vlan capabilities I need. Should I use hAP ax2 router instead?
The cAP ac is a “generation behind”, still would work for your use cases, but just saying if your building something new… If you went Mikrotik for APs, the hAP ax2 likely make a great AP, and offer additional ethernet ports. There is no problem with VLANs running o the hAP ax2. By separating the Wi-Fi from switching/router, you can also use non-Mikrotik AP as there are more options that support AX than Mikroitk at present offer, while still getting RouterOS flexibility to define the networks/firewall/etc. I just wouldn’t mix vendors on the same Wi-Fi SSID.
[RB5009] does not come with a poe out for the access point.
While no PoE out, this isn’t too bad I think. Some stuff is 24V, other use 48V 802.11at, still other need high-power 48V passive – so in some ways using a PoE injector to the RB5009 continues the flexibility add the needed type of power.
Edit: broke OP’s quote in parts for clarity