In rule tab under Switch, you can add a rule with Match, vlan, vlan header not present, which should then only apply the action to packets which don't have a vlan header. Additionally, I think if you set the new vlan id to 0, that means strip.
You can kludge the input/output thing by using the Src and Dst MAC address fields (which can be a range) to match packets coming to/from your radios (in conjunction with the vlan matching, in case your clients have any of those radios as well).
src mac: xx:yy:zz:00:00:00/00:xx:yy:ff:ff:ff
vlan header: not present
mean this packet is from one of my radios
set new vlan id 10.
dst mac: xx:yy:zz:00:00:00/00:xx:yy:ff:ff:ff
vlan id: 10
means this packet is to one of my radios
set new vlan id 0.
where xx:yy:zz is whatever the manufacturer mac id(s) are of your radios. (you may need multiple copies of the rules if there are more than one and they are non-contiguous).
This hinges on vlan 0 really meaning untagged/no vlan.
If its such that incoming vlan-10 is always going to be from cpu, and the radios are always on physical ports, you could probably do away with the src/dst mac, and just use the ports to designate incoming/outgoing. (ex: convert untagged on 1,2,3 to vlan-10, convert vlan-10 on cpu to untagged (vlan-0)).
p.s. If memory serves, I think there is a limit to the number of rules the switch can handle, and it may also be tied into the complexity of the rules, I'm thinking it was something like 32 "steps" but I'm a bit rusty on this.