Dynamic VLAN assignment on Unifi Devices

Framed-Protocol : PPP

Service-Type : Framed

Termination-Action : RADIUS-Request

Tunnel-Medium-Type : 802

Tunnel-Pvt-Group-ID : (VLAN number, as an octet string)

Tunnel-Type : VLAN

USE_TUNNELED_REPLY = YES

Of course you need to set tagged port configuration to the switch connected to the APs.  To connect something to the base (untagged) VLAN, leave the Tunnel-Pvt-Group-ID out for that policy.