Help to Set up Segregated VLAN on L2 Switch

[username0475]

Trying to do my first VLAN setup.
First floor IoT devices is wireless connected to the main router ia a guest network - so I am covered there with a segregated network built into the router.

For 2nd floor - I want to segregate a couple of TP-Link EAP225v3 Access Points so that they are only dedicated to access externally NOT internally for guest & 2nd floor IoT devices .

Just added a Netgear GS108PEv3 L2 managed switch to my network.

Would like help with some steps setting this up since I am unfamilar with some concepts I've been reading about regarding VLANs such as :
Tagging & Trunks.
My topography is attached.
Circled part is VLAN segregation I think....

Please right click pic to open in new tab & zoom for larger view of topography.

 

[coxhaus]

Since I always setup VLANs with a network IP address I setup my VLANs on a layer 3 device first then add the VLANs to the layer 2 device. The layer 3 device needs to support DHCP for multiple IP networks so each VLAN will receive an IP addresses for their clients on their network.