RV110W - trying to set up 2 VLANS - are there docs / help for this?

Question

I am trying to set up an RV110W router with 2 VLANs - 1 for guests to the office to just have internet access via wireless and another for employees to be able to access the LAN and internet wirelessly. I have not done anything with VLANs before, so please bear with me.
I thought this would be simple, but banging my head against the wall with all the terms in the docs:
http://www.cisco.com/en/US/docs/routers/csbr/rv110w/administration/guide/rv110w_admin.pdf
port 1 is connected to a wired LAN / unmanaged switch with office PCs. So these machines / nothing on this subnet tag the packets before they get to the router.  This subnet is using 10.10.1.0/24
Port 2 is connected to an Engenius EAP 300, a wireless access point that can broadcast SSIDs and tie each SSID to a different VLAN.
SSID1 is called Private and is set to be VLAN 1. There's encryption on this SSID - only office staff would be able to log on.
SSID2 is called public and is set to be VLAN 10.  There's no encryption on this SSID.
I know - the router also does this, but where the router is vs. where the wireless is needed, we need to have the Engenius at that remote location.
I have the RV110W set to give out 10.10.1.0/24 IPs when you connect to the SSID1 / VLAN1
And it gives out 10.10.10.0/24 IPs when you connect to the public SSID / VLAN10.
Both get on the internet fine.  The only issue is how to set the VLAN membership for each port / and any other settings so that the wireless devices on VLAN 1 can get to the LAN devices on Port 1.  (and the public / vlan 10 devices on the wireless network to NOT get to the devices on port 1, but i think that's working.
I played with tagged / untagged / excluded, for the port membership, but either the wireless VLAN 1 devices get blocked from even the web (when port 2 is set to untagged, since they ARE tagged VLAN1) or they can't get to port 1 when set to tagged, since the port 1 devices are all untagged and the reply packets get blocked?
the doc for this unit talks about inter-vlan routing but doesn't explain what that is.  THe wireless isolation should be turned on for vlan 10, right? We don't want guests to be able to access other guest's machines?
I saw on page 71 on how to set up the guest network, but that's using the wireless built into the box, not a wireless access point.
Overall, what I want is:
VLAN 1: port 2 (with tagged VLAN1 packets) and port 1 (with untagged packets) can pass data between each other and access the internet
VLAN10: port 2 with tagged VLAN10 packets can only get to the internet.
Is that doable?
How?

Answer 1

thanks.  Still not working
For the vlan membership page
when set like this:
           port1         port 2
vlan1     untagged    untagged
vlan10  excluded     tagged
connecting to the vlan1 wireless SSID on port 2, I can't even get an IP address from the router (the dhcp request can't even come through port 2 because it's saying vlan1 packets have to be untagged?
connecting to the vlan 10 wireless SSID on port 2 gets a DHCP address and can only get to the web, so that's good.
If I change the membership to:
                  port1 port 2
vlan1 untagged  tagged
vlan10 excluded tagged
connecting to both SSIDs on port 2 will get you a dhcp address, and vlan1 devices can get into port 1, but trying to admin the wireless access device on port 2 or even pinging it, now fails -  'cause the router gatekeeper says if you want to come through port 2, your packets have to be tagged? and the packets from port 1 to port 2 are untagged?
If I change the membership to:
            port1 port 2
vlan1   tagged tagged
vlan10 excluded tagged
connecting to both SSIDs on port 2 will get you a dhcp address, but replies from the wired PC on port 1 / vlan1  vlan1 can't get back out of port 1 'cause the router gatekeeper says if you want to leave  through port 1, your packets have to be tagged? and the ping reply is coming form a device with untagged packets?  although the devices on vlan1 / port 1 CAN get on the web with their untagged packets.
the wireless device says it supports 802.1q
http://www.engeniustech.com/resources/EAP300_DataSheet_v2.1.pdf
when they say port 2 / vlan 1 tagged, is it saying packets coming in FROM devices on that port have to be tagged? Or packets going TO devices on that port have to be tagged?  or both directions?
Any advice?