@Vincent-TP Thanks for your answer!

First, probably unrelated: A bunch of wifi devices show up as wired, and I can't force them to the EAP610.

I moved my laptop to the EAP610 (tried both units with the same result, but of course I wasn't expecting a difference), and as soon as it connected to the AP instead of the wifi-router ER706W, it lost connection to the controller. I saw it in the Android app nevertheless in the topology map view and in the AP's client list that the laptop was connected to the AP now. Strangely, the Android app showed a totally empty client list, even though about 12 devices were connected, the list filled later again after I unplugged the AP. Might be just another hickup of the Android app, no idea.

I tried pings now from this laptop to the EAP610 to which it was connected to and to the router's LAN IP, both failed. From devices connected directly to the wifi-router, I can ping the router and have internet connection.

What does this mean?

Could this be related to my ACLs which might be incorrectly? As said, I have two VLANs (each has a LAN and SSID), #1 and #2, all devices are currently in VLAN #1. I set up deny ACLs in between both networks in both directions, in both the Gateway ACL and the EAP ACL tabs, so in total 4 rules. Is this correct, or should they be only in one of the tabs? Or anything else?