From another thread I had open I seem to have found a (better?) solution here.
in /etc/config/network I added
config interface 'vlan10'
option device 'br-switch.10'
option proto 'none'
config interface 'vlan20'
option device 'br-switch.20'
option proto 'none'
And in /etc/config/wireless
config wifi-iface 'wifinet0'
option device 'radio0'
option mode 'ap'
option ssid 'TEST'
option encryption 'psk2+ccmp'
option key 'notused'
option ifname 'wlan0'
option multicast_to_unicast_all '1'
config wifi-vlan
option name 'vlan10'
option network 'vlan10'
option vid '10'
config wifi-station
option key 'foosecret'
option vid '10'
config wifi-vlan
option name 'vlan20'
option network 'vlan20'
option vid '20'
config wifi-station
option key 'barsecret'
option vid '20'
No need for any /etc/hostapd.* files either.
Bridge looks as follows:
# bridge vlan show | grep wlan
wlan0-vlan20 20 PVID Egress Untagged
wlan0-vlan10 10 PVID Egress Untagged
Only caveat that I'm aware of is there are some ath10k bugs reported, so we will see how I get along with this.