@Nvb2 

Yes, for multiple network and subnets topology, the managed switch is more helpful, and is necessary for me. This is a classical case for your reference here, and no more EAPs, you can set the VLAN ID for multiple SSIDs.

The noise of TL-SG3210XHP-M2 is normal, after the switch is powered on, the fan rotates at a constant speed, regardless of whether there is a client connection or the amount of forwarded traffic. Therefore the sound is also maintained at a stable level. The sound caused by the fan rotation is normal. Since this swich are not suitable for home office/small office usage scenarios, so need to place it on a rack/machine room to isolate the noise.

  @Nvb2 You would be giving up a lot of flexibility using just the unmanaged 1000 series switch devices.  At the very least, may I suggest you front end (ie insert between the ER707 and the switches you have picked), something like a SG3210X-M2 that the controller can interact with, then use the 105XX devices for POE injection.  You really need a full Omada managed 'router+switch+AP' to get the most out of the controller solution.

  @Nvb2 

Actually you have the 3210XHP-M2 ie the POE variant.  I am suggesting the fanless non-POE version which you can then use with the SG105's you show above, or other fanless manageable POE switches such as the 2210P.  By doing this you can establish the 2.5G link between the 707 and 3210X-M2, and then LAG two (or more) 1G ports to make a 2G (or higher) connection to the subservient switches

In fact, if you don't use POE at all on your existing 3210XHP...you can probably just disconnect the fan and use it like a 3210X (non-HIgh Power variant) 

  @Nvb2 

1. LAG (LACP) is only supported on TPlink switches at this time.  Yes, you would need to bond 2x1G to continue the higher BW connection downstream

2. My suggested architecture would 'limit' and I use that word lightly, your AP's BW to 1G symmetric (which IMHO is not a significant limitation).  

3. Yes you can bond 3 or more channels if you need more aggregate BW.

My suggestion was all around providing visibility and monitoring using the OC200 in your design.  As soon as you throw unmanaged switches in there, it gets messy.  

That said, your final suggestion of perhaps manually configuring the SG105PP with LAGs and using the Controller to confiuring the LAGs on the 3210 could work.  Alternatively, you could do away with the SG105PP's altogether and replace them with 2.5G capable POE injectors if you only have few devices that need >1G AND POE power.  I have also bought aftermarket injectors to run 12VDC over the passive POE pairs if your APs support that. 

You have a few levers to play with here :)  I will be very interested to see which one makes the most sense for you

  @Nvb2 

In my region an SG105PP is about 3X the cost of a 2.5G capable POE injector.   This would allow you to run everything off the 3210-nonPOE and skip the SG105 layer.  The downside of POE injector over POE switch is you don't have power control (ie ability to bounce the power on one device, or to de-power a device overnight)

The bad news is the SG105PP is not a 'Smart Switch', so you won't be able to configure LAGs on it, not that you need to as it already supports up to 2.5G uplink.  It is really just a 2.5G port expander with POE.

  @Nvb2 

I think you can reasonably assume that in the next year, there will be SOHO switches released by TPlink that have 2.5G ports like the SG105PP, but which are compatible with Omada controllers.  Given where you want to go, I wouldn't 'build out' completely today, I would take an interim approach

So my standard config is ER707 connected to an SG2210P.  That gets you 8 POE+ ports, with 62W power budget and both boxes are fanless.  I would not spend money on SG105PPs UNLESS you can live with the following info in italics below (stolen shamelessly from a reddit post by gjs520820) about gateway ACLs for devices connected to the SG105PP's, OR, if you simply want to use them as port expanders for identical devices (ie 3 identically configured APs attached to SG105 which is plugged into SG2210P or similar) and that only makes sense if you are running out of ports on the 2210.

Gateway ACL's are stateful. Meaning a gateway deny acl will allow the denied vlan to reply to a request, but it can not initiate a request. Currently under Controller mode gateway ACL's can only be written at the LAN level. Meaning you can block or allow the entire vlan, but not IPgroups or IP_Portgroups.

Switch level ACL's are not stateful, but can be written to block individual or groups of clients and also define ports to be allowed or blocked.

It would depend on your network, but with the gateway ACL's only acting at the LAN level makes them almost useless.

So use the 2210P for now...more than enough to power your OC200 and 3-4 APs at gigabit speeds with full Omada functionality and 'limp' along at Gigabit speeds :)  When the inevitable SGXXXX comes out that has 2.5G ports, then add that to your solution attached to the 2.5G LAN port on the ER707 and move your high speed APs over to that.

Oh and I wouldn't spend money on the 3210 switch unless you have a need to run fibre off it's 1Gbps SFP's.