@JamesLu 

you can only do it on a vlan switch. on router you cannot remove LAN or vlan1 on a port.

on router all ports are untagged with vlan1.
the only thing you can do is change pvid on a port, you do that on router property and port.

but why do you use a separate access point for guests, can't you use vlan and give the guests access to the ordinary access points?

  @MR.S Is there a good general reference on the VLAN behavior, tags, etc. other than the user guide?

  @JamesLu 

https://community.tp-link.com/en/business/forum/topic/682406

  @MR.S 

I created a second LAN and associated VLAN for the port connected to my guest network wifi AP, seems to work, but the new LAN still can access the original LAN. Any way to isolate the two?

  @JamesLu 

In the Firewall - Access Control section, create a policy that blocks the direction LAN_NEW->LAN_ORIGINAL where the source network is LAN_NEW and the destination network is LAN_ORIGINAL
This way you will have internet but you will not be able to access the equipment on your original network through that Wi-Fi, but you will be able to access that AP from your original network. You can block both directions if you want. I hope it helps you.

  @David11 I ended up with blocking LAN->LAN with source AP destination !AP type ANY, and LAN->LAN with source AP destination Me type HTTP.