Yes first set up an "admin" network so you can always log into the AP directly by wifi even if Ethernet is misconfigured. This network should have a static IP address of something .1 which is a different subnet range than anything else you're using. It should have a DHCP server, and of course a wifi AP. It doesn't need a firewall zone or any firewall rules as long as the default rule is to accept input and output. Or you can place it in the lan zone.
In DSA, in order to tag packets on a port and also have the switch properly add and remove tags and hardware switch to other ports, you must use bridge-vlans. The notation 'lan1.X' is not valid in any bridging situation which will also involve hardware switching.