Hello Michael,
The answer to your question is Yes!!.. You need to create an Ethernet port profile and assign that profile to the AP's second port via the AP group or AP directly. In the profile you specify the VLAN to use on that port when tunneled. Similar to how you do the WLAN, but a lot less complex.
Have fun!