@xmtr34 

Okay, I have 3 SSIDs on my remote AP too, each with their own VLAN/subnet.  I treat the connection between the outdoor and indoor like an unmanaged switch (which is what you did when you Forgot your switch).  You should be able to replicated that by removing all Port Profiles on the 2008.  Your 620? AP will still tag traffic from each SSID, and because of the L2 nature of a switch, it will stuff those tagged packets into the ethernet port of the 225 which will duly punt them across the wireless link to the wired 225 which delivers them to the managed port of your local switch (at which point you can deal with VLAN isolation etc.).  I think you're very close to a workable solution.  At the very worst, you should be able to isolate two of your remote 2008P ports and restrict forwarding between them, so Isolate 3, forward only 4, Isolate 4, forward only 3.  This should keep them away from the managed portion of the switch and whatever that does to your setup that's breaking things...but mostly I suspect you are tagging packets on the AP ports when what you only need is a single untagged VLAN between them.  Make sense?