Last year I installed 4011iGS+ router and a couple of cAP ACs in my home. The cAP ACs are hardwired (Cat 6A) back to the router. I installed one cAP at the east end of the house and the other cAP 75 feet away at the west end of the house. On balance this setup works well. So far for the past year my network overall and the wifi has been very stable. Getting CAPsMAN up and running was a real challenge for a rookie however now it does a great job. My network is all new MT hardware and all of the components are running v6.47.8 of the routerOS.

As a rookie / newbie I am curious. The wifi experience as I walk around the house with phones and tablets is seamless. I don't notice speed changes or disconnects. Is this because CAPsMAN automatically manages the connectivity and handoffs between my two cAPs at each end of the house when I move from one end of the house to the other?

I am at the point now becoming more confident that I'd like to start fine tuning stuff. I want to add a US based VPN service with a dedicated cAP for VPN only wifi usage. I am adding an RB260GSP switch to help out with POE loads ( 2 existing cAPS and one or two other devices). I plan to use port 10 (POE) on the RB4011 for the VPN service. Any comments or suggestions on this?

Is this because CAPsMAN automatically manages the connectivity and handoffs between my two cAPs at each end of the house when I move from one end of the house to the other?

No, CAPsMAN doesn't do any of this. Your client devices decide when and where to roam on their own.

Instead of adding an additional cAP, you might want to consider introducing VLAN's. Where you can have a standard VLAN and an additional VPN VLAN. That would make any additional hardware (for this purpose) unnecessary.

If you want to find out more about VLAN (I'm using it for guest network and IoT), please read this great tutorial:
viewtopic.php?t=143620

Thank you for the VLAN suggestion. I had to add the switch because of POE requirements and the fact that I was running out of ether etc ports on the 4011. The individual POE injectors are a bit messy and the way I have done it with the switch I now have 5 POE ports.