Nah, you cannot do it with 5400X, if you want to base it on VLANs. Despite the cost it is still SOHO device, so it doesn't support 802.1Q on LAN ports. If you had TL-ER6120 (or some cheap Mikrotik), then you would easily configure it with adding your VLAN's (tagged) on LAN-port, so everything would work. 

So, until you have 5400X forget about VLANs. 

Port Isolation will work like you said, it is true, so it will isolate based on ports on switch, so you can't filter wireless clients.

I do not now, how Guest Network works on 5400X, but in general in should not allow wireless clients connect to LAN. If it is so, then configure guest network + port isolation, it would be enough for what you want.

Thank you for your helpful reply and for your confirmation that this won't work with a consumer router. I suppose I can get a VLAN-aware Ethernet router to go between my cable modem and then connect the switch and wireless router ot it, right?

Hi lanA

I see that C5400X guest network has the option of "Allow guests to access each other" and "Allow guest to access my local network". The geust network should be able to isolate the wireless clients and wired clients, maybe can meet your demand. 

Even if you get a VLAN-aware Ethernet router, if your wireless PC is connected to C5400X, you still need to consider how to isolate the wireless clients and wired clients.

Hi Andone,

I have taken advantage of those features on the guest network and they work well.  I ended up returning the Tp-link switch and going with a Ubiquiti Edgerouter 10X which also has 10 gigabit ports and a switch chip.  I'll turn the C5400X into an access point and create VLANs with router/switch for the wired devices.  I wish Tp-link had something similar but the VPN routers would also require me to have a switch and I'm trying to keep the costs and pieces of equipment down.

The latest version of TP-Link SMB Router supports VLAN and it can meet your requirements that isolate the devices. But unfortunately TP-Link SMB router doesn't have wireless function, otherwise, you just need to buy a router which support VLAN and wireless.(The wireless still need to support isolation)