VLAN for guest SSID in AP mode

[Slartibartfast]

This is a pretty complicated use case and I'm not sure if Merlin or anyone else here can help me but it can't hurt to ask. I have mentioned before here that I have an unusual configuration which comprises a bridged modem/router from my ISP feeding into a pfSense firewall residing in a VMware VM. The output of the pfSense instance is fed out through a physical NIC on the host PC into an RT-AC68U in AP mode which provides both WiFi access and four wired ports (was an RT-AC66U until last week but now the '66 is a media bridge in my living room). This works great but since the '68 is in AP mode any guest SSIDs I create are on the same VLAN as the main SSID and anybody connecting to them has access to all devices on my LAN just like the primary SSID. Both the '68 and pfSense can do tagged VLANs, so what I want to do is manage the guest network from pfSense and trunk the guest VLAN to the '68, connecting only the guest SSID to it.

I have found a lot if info via Google about switching one or more physical ports between any VLANs on the Asus device using robocfg, but nothing on doing the same with a virtual interface. When I enable a guest SSID on the '68 I get a new virtual interface called w10.0 but I have no idea how to move that from VLAN1 to VLAN3. Has anyone got any experience with anything like this?

Thanks in advance.