Yes, if you create a separate subnet for the APs on the pfSense server and use VLANs to connect the devices to this subnet. To be able to do so, yout must configure the pfSense to either use VLANs or to assign an Ethernet port to this subnet.

You need to create a trunk (tagged) port on the switch for pfSense and the UniFi and an access (untagged) port for your PC. Assign PVID 2 to the access port and let PVID 1 assigned to the trunk port.

rcmpayne wrote

So from watching a few vids and docs online, PVID is the default vlan assigned to any non-aware vlan device (vlan 1 in my case) and that when you have a device that can be configured to use vlans, you need to tag them.

As soon as you use VLANs and want to isolate them against each other (not only force traffic through a specific device) you need to tag all Ethernet frames, be it in the server, in the router or in the switch. You can reach every port b/c all ports of the switch are still members of the Default_VLAN 1. However, the UniFi SSID tagged with VLAN 2 is forced to use the router's VLAN 2.

Tagging traffic arriving on VLAN-unaware port(s) in the switch is done by setting their PVID.
Forcing traffic to certain ports is done by adding those port(s) as member to a VLAN.
Isolating traffic to certain ports is done by removing those port(s) from the VLAN.

If you want to isolate ports from Default_VLAN 1, you need the latest firmware for the TL-SG105E published in January 2018. This firmware lets you remove ports from VLAN 1, but you need to use the switch's web UI, not the Easy Configuration Utility.

Also make sure that pfSense does not route between the subnets/VLANs by isolating the subnets against each other (might be default or requires a firewall setup - I don't use pfSense, so you certainly know better how to achieve this in pfSense). Keep in mind that UniFi APs use untagged frames for management, so if you use UBNT's discovery or an AP Controller, you still need to pass untagged frames between the UniFi, the switch and the router.