I have an RT-AC88U. I assume it would be the same as yours?
Sorry based on what Colin said, makes sense to check.
SSH into the router
do "robocfg show" If you get an output, then you're golden, changing is very easy.
This is what I have on my script:
robocfg vlan 1 ports "1 2 3 5t" - remove port 4 from VLAN 1
robocfg vlan 501 ports "1t 5t" - trunk (tag) 2.4ghz guest VLAN 501 out to my other access point which is on port 1 (and remove 501 from other ports since not needed there)
robocfg vlan 502 ports "4 5t" - put LAN port 4 into 5ghz guest VLAN 502 (and remove 502 from other ports since not needed there)
You always have to have "5t" as that is the CPU. You need to have 386 code (or newer) and Guest wireless 1 enabled for this to work (reboot after enabling guest wireless to ensure all the vlan configs get applied, on mine 502 didn't show up until after reboot).
Net result of above is port 1 sends VLAN 1 untagged and VLAN 501 tagged to my other AP which handles both regular and guest SSIDs.
port 2-3 are normal untagged LAN ports in VLAN 1
Port 4 is untagged guest port in VLAN 502
I used 501 for other AP since it is 2.4ghz only and 502 since a wired gig port is "high performance" which seemed to go well with 5ghz guest. In reality, it doesn't matter, you can use one, the other, both, whatever you want. If you want two guest ports I'd put them in the same VLAN if you want them to be able to see each other and have good throughput (will bypass the router and just use the switch) or put them in separate VLANs if you don't want them to see each other. So two guest ports in 501 should be able to do a full gig between each other. One in 501 and one in 502 won't be able to see each other at all but will be able to access the internet.