We have some WSAP devices that have 2 accessible ethernet interfaces on the front. I want these ports to either be disabled, or bridged with the wireless interfaces so if any guests plug in to these ports they get access to the hotspot network and not the uplink interface that the WSAP is connected to

What's the easiest method to do this? preferably without having to reconfigure all the devices. I can't find any mention in CAPSMAN of bridging ethernet ports, it looks like i'd have to do it manually?

You'll have to do it manually indeed. capsman only configures wireless interfaces, but doesn't touch neither bridge or any other interfaces.