What I want to achieve is each non-WAN port on hEX having seperate lan address space, and I have several of these 'dumb' switches that I could connect to each of the non-wan ports to get more ports for each of the new lan spaces.
If this is so, then use router's ports as completely independent interfaces (no VLANs needed whatsoever):
- decide which ethernet port will carry LAN which will be used for management. For sake of this exercise let's say it will be ether2.
- connect to router via any of LAN ports except for the future management port, let's say you'll use ether3 this time
- remove ether2 from bridge. Configure IP address (different subnet from what you currently have), add DHCP server (complete with pool etc.)
Configure firewall filter rules. If your current firewall is still largely based on default, then add ether2 interface to interface list LAN
- connect to router via ether2. Enter safe mode (google it if you don't know how to enter it)
- remove all remaining ether ports from bridge. Remove IP address from bridge, remove any other IP setup (DHCP server, ...) which binds to bridge. Remove bridge from interface list LAN.
- finally remove bridge.
- if management connection didn't break (meaning you didn't do anything excessively wrong), exit safe mode.
Now you have etherX ports which can be configured as separate interfaces, each with different VLAN subnet.
Note that default firewall filter isn't exactly made for multiple LAN subnets, so you'll have to do something about it. E.g. by default, firewall lets all LAN subnets to communicate with each other. If that's not what you want, you'll have to add firewall filter rules (or firewall raw rules, but I suggest filter rules if you don't know exactly what you're doing) which will selectively block some of those communication. Etc. Also note that interface list LAN is slightly special in default firewall setup as it allows (unlimited) connectivity to router itself. You probably don't want to allow it from all of subnets, so don't blindly add all subnets to LAN interface list.
Using "physical subnets" approach, as outlined above, has its merits (more straight-forward physical infrastructure), but also lacks flexibility - leading to need for more physical infrastructure, e.g. need for multiple parallel cables towards "remote" switches, need for more switches (one per LAN), also more physical work when one wants to move a device from one LAN to other one. In today's world, using VLANs in such scenarios is more common.