Well that's bloody good timing. The following HOW-TO is for a IoT Wi-Fi-backed VLAN for a Slate 7 but the uci commands should work just fine on all your listed devices. Just change the network port names to match the specific device's as only your Beryl AX has a 2.5 GbE port & I assume you're using that for its WAN.
These statements are a direct contradiction. A network is a subnet. If you want to pass traffic back & forth between your primary LAN/subnet 192.168.8.0/24 to a VLAN you're going to want to adjust the firewall's zone forwarding & rules to match. In the HOWTO lan is 192.168.8.0/24 while iot is 192.168.25.0/24.
A simple AP would get its connectivity from the upstream router & be attached to the same subnet as said router. It's up to you if you want to 'tag' it to be on a VLAN.