This is my typical use case for the Tags:
All APs have the Tag "Prod-AP".
All 802.1X SSIDs are configured to only get broadcasted on APs that have the Tag "Prod-AP".
What is the benefit?
When I need to exchange an AP, the replacement AP will start with an IP that is not yet known to the RADIUS server. If a client would already connect to this AP, the connection would fail.
But without the Tag, the SSID is not announced yet, and I have time to set the DHCP reservation for the new AP. After the AP gets its "correct" IP, I set the Tag, and the SSID gets broadcasted.
If you found this post helpful, please give it Kudos. If my answer solves your problem, please click Accept as Solution so others can benefit from it.