Do it in reverse order from what you did. In other words have everything else ready before creating the wifi AP, so that its network already exists and you can choose it from the wifi page. Do not try to back-reference wifi interfaces from other parts of the configuration, since their names may change.
So first get the Ethernet VLANs set up. For DSA to be able to have the hardware Ethernet switch work properly, all the ports that are going to hardware switch different VLANs need to be in the same bridge, with VLAN filtering enabled on that bridge. This generally means that the existing br-lan will become a general purpose bridge, and you may even want to put the wan port into it (which will require giving the wan link an internal VLAN number, conventionally from swconfig that number is 2, but you can choose any number which isn't used for something else). Set the ports tagged or untagged depending on your needs. A trunk cable has all VLANs of interest tagged, and none untagged. An access port for a non-VLAN aware device has one VLAN untagged and the rest off.
Then create new networks for each VLAN. Even if a VLAN will only be hardware switching between two Ethernet ports, you still need a shell interface of proto Unmanaged for the hardware to get set up properly. Use the syntax brigename.N as the interface's physical device. In the full-on DSA VLAN filtering configuration scheme, this is the only place where a .vlannumber syntax is used.
At this point you will have a network for your L2 bridged guests named something like vlan20 or guests, which has br-lan.20 as its device and Unmanaged as it's protocol. One of the Ethernet ports is configured as Tagged in VLAN 20 and connected to the main router. In other words, everything but the wifi is in place. So now go to the wifi section and make an AP, possibly one on each band. Select the network name from the list.
The thing about Luci's list of network names is it will have a lot of ones that should never be used in that context, or ever.