Question on implementing Vlans

HI all!

I have a sonicwall nsa 2650 with port 1 to our Comcast modem, port 2 as gateway for staff network x.x.0.1/24, port 3 as gateway for public WiFi x.x.99.1/24, and port 4 for gateway for a few public use computers we have in our lobby x.x.50.1/24

I have 5x tp-link 48 port managed switches that our endpoints connect too, with an 8 port poe with 8x ubiquiti nano-hd WAPs connected to it.

I’m wanting to implement 4 vlans, 100 for staff, 200 for public access PCs, 300 for WiFi, and 400 for a future credit card reader.

My understanding of vlans would be to set each port for whatever device plugs into it for each network as Untagged for the corresponding vlan (ports with staff machines untagged 100, public PCs untagged 200, WiFi untagged 300 etc)

I then set the port that connects to the next tplink switch (typically port 48) as tagged to act as a “trunk” correct?

Is there anything I’m missing with this? This will be my first implementation of vlans.

Appreciate it!

TLDR: am i correct to assume i UNTAG all ports connected to each "group" of endpoint devices, and TAG the "trunk" ports the connect the managed switches?

Thanks!