Ms switches can do 802.1Q, just configure a port to be a trunk. If you want a layer3 svi on the switch thats also possible with MS355-48X, then you need to enable the routing.
Where is you routing configured now?
Why you want another vlan? Ms switches/vlans cant do shaping.
So you need to do shaping on the ssid or on the router. And you can also do firewalling on the ssid if needed