VLAn tagging / untagging

I’m trying to setup a VLAN but am confused on the whole tagging / untagging. The endpoints seem easy - it’s middle I’m confused with.

At the furthest edge of my network I have an Ubiquiti AP which will tag packets from a specific SSID as VLAN 3 and the other SSIDs will be VLAN1.

The other end is an Ubiquiti router with a VLAN 3 interface with different firewall rules from VLAN1.

The middle is where I get confused. The router is plugged into Switch A port 1 which is uplinked from port 2 to Switch B port 3 which connects to the AP on port 4. Both switches are TP-Links which support VLAN / 802.1Q VLAN.

So basically:
Router to A1 to A2 - uplink - B3 to B4 to AP

I want VLAN3 to only work on the ports above - but how to do I allow VLAN3 and VLAN1 traffic to arrive and leave with the same VLAN# - tag/untag make no sense here. What am I missing?

I just want all the other ports to reject VLAN3 traffic... Here’s the tplink doc on this.

Thanks!