i think you mis understand the theory of AP mode and how it relates to any router
ap mode bypasses all router functionality ( or should ) , basically the wan port just becomes another lan port and nothing else works apart from the wifi , its actually the same as if you run wan bypass on any router regardless of if it has a specific ap mode or now
if your device is in AP mode what ever device it is connected to or in front of it is doing the router function and it is the one you set such things as qos and parental control / firewall rules
if an AP has any control it must then create a second nat and thus you end up with dual nat issues and may as well not set the device in ap mode in the first place and rather just run it as a second router
pete
edit
and to your title question you should be doing this one what ever you are using as your main router seeing as the the r7800 is in ap mode
Policy Controls are part of the routing functionality in most Router/AP's - specifically in the Router side, not the AP side...
So when repurposing a Router/AP as an AP, one needs to look at the Gateway/Edge side for policy controls as that is where the LAN/WAN/WLAN boundary/edge is..
AP's on the WLAN follow policies set by the Gateway in most cases...