@scales11 I feel like you have been greatly helped by @cookiemonster already, but I just want to point out it doesn’t matter which WiFi standard your IoT/Guest networks are on which device. You bind a specific wifi interface to a specific network. Moreover, if you want both LAN and IoT on 2.4GHz (wifi4) on your AP, create two separate wifi interfaces there and bind one to your LAN and another to your IoT interfaces, like:
config wifi-iface 'default_radio1'
option device 'radio1'
option network 'lan'
option mode 'ap'
...
config wifi-iface 'iot'
option device 'radio1'
option network 'iot'
option mode 'ap'
...
I may be wrong here, but I suspect your question about VLAN matching by MAC is due to you not realizing you can easily set up multiple wifi interfaces binding to different networks.
I’ve also faced the similar challenge with the IoT-only cameras and the controller for that that can’t be dual-homed and lives on LAN recently and with the suggestion from @psherman I’ve made it work: Unifi protect on main VLAN + 3rd party cameras on IoT VLAN - #6 by psherman . I can’t do any hand-holding while you implement the same, but it’s a starting point where someone else can maybe help you further based on that known-working config.
In your case, if your cameras controller can be moved to IoT, that would be easier to expose just the controller from IoT to your LAN, than exposing multiple cameras from IoT to LAN.