Disclaimer: I have not tested this.
Current ZD 9.12 has the ability to assign a VLAN to a Role, after you enable Role Based Access Control Policy.
Then assign the Role to your User, attempt to login to the WLAN(s) allowed for this User's Role, and see if the VLAN
gets changed after successful authentication?