Here's a link to the previous thread if others need more context.
I am having trouble understanding how those work together. Unifi (by default, and required when adopting) use the untagged connection for management. You can use the untagged connection for an SSID (and I believe for a guest id that will use the same subnet, but will block traffic to "private" address space at the AP L2/L3 layers).
The bridge on the CCR2004-16G-2S+ (r1), hap ac2 (sw-bureau), hEXPoE (sw-schuur) are all currently configured without vlan-filtering enabled, so they are currently "vlan transparent", meaning that the bridge will just relay ethernet frames as is, using only the mac addresses for forwarding decisions, and ignoring the EtherType. In this configuration the bridge will allow vlan tagged frames to pass-through, but will never add or remove vlan tags. This is similar to all "dumb" non-managed switches made in the last 20 years.
The bridge in the CRS32CRS328-24P-4S+ (sw-zolder) switch is configured with vlan-filtering on, but with all bridge ports in the same vlan (the default vlan 1), and with all ports configured as access ports for vlan 1 (pvid=1). These aren't displayed in the standard export, since they are default values, if you export verbose you will see all the settings (and it will be overwhelming).
Because the CRS32CRS328-24P-4S+ (sw-zolder) switch is configured with vlan-filtering on (and the default ingress-filtering when vlan-filtering is enabled), any tagged frames for other vlans will be dropped, so the switch will no longer allow other vlans (tagged) to pass through. So only untagged frames will reach the APs directly attached to the sw-zolder switch (as it is currently configured).
The more general way to set up SSIDs is to have vlans tied to SSID's, e.g. a separate vlan for each SSID. Then you can use the router's firewall to block access to other subnets, but still allow access to the internet, e.g. the IoT devices could be allowed to communicate with each other within the same vlan, and be allowed access to the internet.
Are all of the 4 SSIDs working at this time? Or is the only one working the one associtated with the "main" 192.168.1.0/24 untagged subnet. I did see you mentioned that you had a hot-spot for the guest network.