No problem, I could have been more specific with the general setup in the first place. Just to make this clear, you are correct: 'ap001' is the CAPsMAN controller, the other two cAP ax's are configured as CAPs, no other MT components involved. Configuration profiles of 'ap001' are configured directly on the interfaces.
Here's a config export:
[admin@ap001.of.kdk.network] /interface/wifi> /export
# 2024-03-12 14:41:57 by RouterOS 7.14
# software id = LNBX-T6UL
#
# model = cAPGi-5HaxD2HaxD
# serial number = <serialnumber>
/interface bridge
add admin-mac=<mac> auto-mac=no comment=defconf name=bridge port-cost-mode=short vlan-filtering=yes
/interface ethernet
set [ find default-name=ether2 ] disabled=yes
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface wifi channel
add band=2ghz-ax disabled=no frequency=2412 name=2G_ch1 width=20mhz
add band=2ghz-ax disabled=no frequency=2427 name=2G_ch6 width=20mhz
add band=2ghz-ax disabled=no frequency=2452 name=2G_ch11 width=20mhz
add band=5ghz-ax disabled=no frequency=5260 name=5G_ch58 width=20/40/80mhz
add band=5ghz-ax disabled=no frequency=5500 name=5G_ch106 width=20/40/80mhz
add band=5ghz-ax disabled=no frequency=5580 name=5G_ch122 width=20/40/80mhz
/interface wifi datapath
add bridge=bridge disabled=no name=dyn_vlan
/interface wifi security
add authentication-types=wpa2-eap,wpa3-eap connect-priority=0/1 disabled=no ft=yes ft-over-ds=yes name=wpa-eap
/interface wifi steering
add disabled=no name=steering1 neighbor-group=ng1 rrm=yes wnm=yes
/interface wifi configuration
add channel=2G_ch1 country=Germany datapath=dyn_vlan mode=ap multicast-enhance=enabled name=KDK_2G_ch1 security=wpa-eap ssid=KDK-mt steering=steering1
add channel=2G_ch6 country=Germany datapath=dyn_vlan mode=ap multicast-enhance=enabled name=KDK_2G_ch6 security=wpa-eap ssid=KDK-mt steering=steering1
add channel=2G_ch11 country=Germany datapath=dyn_vlan mode=ap multicast-enhance=enabled name=KDK_2G_ch11 security=wpa-eap ssid=KDK-mt steering=steering1
add channel=5G_ch58 country=Germany datapath=dyn_vlan mode=ap multicast-enhance=enabled name=KDK_5G_ch58 security=wpa-eap ssid=KDK-mt steering=steering1
add channel=5G_ch106 country=Germany datapath=dyn_vlan mode=ap multicast-enhance=enabled name=KDK_5G_ch106 security=wpa-eap ssid=KDK-mt steering=steering1
add channel=5G_ch122 country=Germany datapath=dyn_vlan mode=ap multicast-enhance=enabled name=KDK_5G_ch122 security=wpa-eap ssid=KDK-mt steering=steering1
/interface wifi
set [ find default-name=wifi2 ] configuration=KDK_2G_ch11 configuration.mode=ap disabled=no name=ap001.of.kdk.network-2G security.connect-priority=0
set [ find default-name=wifi1 ] configuration=KDK_5G_ch58 configuration.mode=ap disabled=no name=ap001.of.kdk.network-5G security.connect-priority=0
/interface bridge port
add bridge=bridge comment=defconf interface=ap001.of.kdk.network-5G internal-path-cost=10 path-cost=10
add bridge=bridge comment=defconf interface=ap001.of.kdk.network-2G internal-path-cost=10 path-cost=10
add bridge=bridge interface=ether1 internal-path-cost=10 path-cost=10
/ip firewall connection tracking
set udp-timeout=10s
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface bridge vlan
add bridge=bridge comment=kdk-of-cl01-303 tagged=ether1,ap001.of.kdk.network-5G,ap001.of.kdk.network-2G vlan-ids=303
add bridge=bridge comment=kdk-of-dvc-305 tagged=ether1,ap001.of.kdk.network-2G,ap001.of.kdk.network-5G vlan-ids=305
/interface dot1x client
add eap-methods=eap-peap identity="ap001\$" interface=ether1
/interface list member
add comment=defconf interface=bridge list=LAN
/interface wifi capsman
set ca-certificate=auto certificate=auto enabled=yes interfaces=bridge package-path="" require-peer-certificate=no upgrade-policy=suggest-same-version
/interface wifi provisioning
add action=create-dynamic-enabled comment=ap002_2G disabled=no identity-regexp=ap002.of.kdk.network master-configuration=KDK_2G_ch1 name-format=%I-2G supported-bands=2ghz-ax
add action=create-dynamic-enabled comment=ap002_5G disabled=no identity-regexp=ap002.of.kdk.network master-configuration=KDK_5G_ch106 name-format=%I-5G supported-bands=5ghz-ax
add action=create-dynamic-enabled comment=ap003_2G disabled=no identity-regexp=ap003.of.kdk.network master-configuration=KDK_2G_ch6 name-format=%I-2G supported-bands=2ghz-ax
add action=create-dynamic-enabled comment=ap003_5G disabled=no identity-regexp=ap003.of.kdk.network master-configuration=KDK_5G_ch122 name-format=%I-5G supported-bands=5ghz-ax
/ip address
add address=192.168.88.1/24 comment=defconf interface=bridge network=192.168.88.0
/ip dhcp-client
# DHCP client can not run on slave or passthrough interface!
add comment=defconf interface=ether1
/ip dns
set allow-remote-requests=yes
/ip firewall filter
add action=accept chain=forward comment="defconf: accept in ipsec policy" ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" connection-state=established,related hw-offload=yes
add action=accept chain=forward comment="defconf: accept established,related, untracked" connection-state=established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid
add action=drop chain=forward comment="defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat connection-state=new in-interface-list=WAN
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" disabled=yes ipsec-policy=out,none out-interface-list=WAN
/ipv6 firewall address-list
add address=::/128 comment="defconf: unspecified address" list=bad_ipv6
add address=::1/128 comment="defconf: lo" list=bad_ipv6
add address=fec0::/10 comment="defconf: site-local" list=bad_ipv6
add address=::ffff:0.0.0.0/96 comment="defconf: ipv4-mapped" list=bad_ipv6
add address=::/96 comment="defconf: ipv4 compat" list=bad_ipv6
add address=100::/64 comment="defconf: discard only " list=bad_ipv6
add address=2001:db8::/32 comment="defconf: documentation" list=bad_ipv6
add address=2001:10::/28 comment="defconf: ORCHID" list=bad_ipv6
add address=3ffe::/16 comment="defconf: 6bone" list=bad_ipv6
/ipv6 firewall filter
add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid
add action=accept chain=input comment="defconf: accept ICMPv6" protocol=icmpv6
add action=accept chain=input comment="defconf: accept UDP traceroute" port=33434-33534 protocol=udp
add action=accept chain=input comment="defconf: accept DHCPv6-Client prefix delegation." dst-port=546 protocol=udp src-address=fe80::/10
add action=accept chain=input comment="defconf: accept IKE" dst-port=500,4500 protocol=udp
add action=accept chain=input comment="defconf: accept ipsec AH" protocol=ipsec-ah
add action=accept chain=input comment="defconf: accept ipsec ESP" protocol=ipsec-esp
add action=accept chain=input comment="defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=input comment="defconf: drop everything else not coming from LAN" in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid
add action=drop chain=forward comment="defconf: drop packets with bad src ipv6" src-address-list=bad_ipv6
add action=drop chain=forward comment="defconf: drop packets with bad dst ipv6" dst-address-list=bad_ipv6
add action=drop chain=forward comment="defconf: rfc4890 drop hop-limit=1" hop-limit=equal:1 protocol=icmpv6
add action=accept chain=forward comment="defconf: accept ICMPv6" protocol=icmpv6
add action=accept chain=forward comment="defconf: accept HIP" protocol=139
add action=accept chain=forward comment="defconf: accept IKE" dst-port=500,4500 protocol=udp
add action=accept chain=forward comment="defconf: accept ipsec AH" protocol=ipsec-ah
add action=accept chain=forward comment="defconf: accept ipsec ESP" protocol=ipsec-esp
add action=accept chain=forward comment="defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=forward comment="defconf: drop everything else not coming from LAN" in-interface-list=!LAN
/radius
add address=10.200.1.101 comment=com01.of.kdk.network service=wireless
add address=10.200.1.102 comment=com02.of.kdk.network service=wireless
/system clock
set time-zone-name=Europe/Berlin
/system identity
set name=ap001.of.kdk.network
/system note
set show-at-login=no
/system ntp client
set enabled=yes
/system ntp client servers
add address=ntp01.of.kdk.network
add address=ntp02.of.kdk.network
/system routerboard mode-button
set enabled=yes on-event=dark-mode
/system script
add comment=defconf dont-require-permissions=no name=dark-mode owner=*sys policy=ftp,reboot,read,write,policy,test,password,sniff,sensitive,romon source=\
"\r\
\n :if ([system leds settings get all-leds-off] = \"never\") do={\r\
\n /system leds settings set all-leds-off=immediate \r\
\n } else={\r\
\n /system leds settings set all-leds-off=never \r\
\n }\r\
\n "
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN