First of all, you should have Internet no matter which VLAN you choose for the Ethernet port. But don’t tag the port though. And make sure that your computer is using DHCP, not static IP address.
For VLAN assignment, the basic idea is to put your most secure devices on LAN. Other devices go to other VLANs.
By default, devices on LAN can talk to each other, can initiate communication with devices on other VLANs, and can log in the router. Devices on other VLANs have access only to the IP address page and the Ad block control page on the router – they can’t see the login page.
So if your desktop PC connected to LAN port 1 is a trusted device then port 1 should be assigned to LAN. If it’s a risky device that provides services to the public Internet, then it should be assigned to another VLAN and be isolated from the rest of your network.
For WiFi, you can create up to 4 SSIDs each band, assigned to different VLANs. It’s a know bug that Cipher always displays “Auto” even when configured as “AES”. This will be fixed in the next update (coming soon).