Ah, got it. That plan should be great. You can segment your own wired+WiFi network with that hardware, and even do Wireguard from the hAP ax2 to get whole-network egress via an outside VPN service at a good data rate, if you want.

The other devices you might consider as the router are the GL-iNet Slate series. They will be slower as a VPN router, but they’re pretty small and light. They come with a skinned OpenWRT, but in most cases you can install a build of the unmodified OS if you want.