Read through this tutorial. You should get idea how to configure things properly and on CRS3xx that kind of setup is fully HW offloaded.
Just an advice: don’t use untagged "V"LAN … go for all-tagged setup and use access ports for end devices without VLAN support. For 3rd party APs use hybrid ports and tag the untagged part on the CRS port.