I should have mentioned that the thread I referenced previously includes the following,
/etc/hostapd.wpa_psk needs to specify which passphrase should be go into which VLAN ID (in this example, clients connecting with the passphrase "supersecret" will go into VLAN ID 101):
vlanid=101 00:00:00:00:00:00 supersecret
/etc/hostapd.vlan needs to specify the wifi interface created for each (possible) VLAN ID. This can be named anything, but for consistency I choose to name it like a VLAN-tagged interface:
101 wlan0.101
This will result in:
creation of the wifi interface wlan0.101 as specified in /etc/hostapd.vlan
This led me to think that clients attached to a given SSID would have not only their own vlan (101) but also their own interface (wlan0.101).
The firewall should then provide isolation unless FORWARD was set to ACCEPT by default.
I'm assuming that hostapd automatically creates the interface wlan0.101, but I could well be deeply confused.