If you maintain a separate management VLAN for your ZD and APs, that's normal and best practice.
You need to support the default VLAN of the 802.1x WLAN that you define, *and* the additional VLAN(s) you want the user Role to specify.
The new 'Dynamic VLAN' is assigned to the client by their authentication, then a COA or DM, will disconnect the client who immediately is
re-associated and assigned to the specified new VLAN. Client DHCP request goes out on that VLAN, etc from there.