Elderly equipment was limited (device port or trunk port, never the twain shall meet.)
More recent (by which I do not mean new) equipment is less limited, and can have ports that have both untagged and tagged traffic (from different VLANs) on them. I have 3com (so you know they are not new) switches from both of these flavors, and the older ones are on the shelf.
Under the "modern" scheme ports have several settings that govern how they behave - incoming untagged traffic can be assigned to a VLAN, while incoming tagged traffic is left on the VLAN it's on; or incoming untagged traffic can be discarded (which is more similar to an older trunk port setup.) Traffic tagged with a VLAN that's not assigned to the port is dropped in any case. Outgoing traffic from one VLAN can be untagged as it exits the port - any others need to be tagged, or all can be tagged (similar to an older trunk port).
While it is uncommon for most end-users to use (or understand) the functionality, "end-user" computers can in fact handle VLAN tagging, and it's folly to assume they cannot (don't expose something to end users in the belief they can't touch it.) I have a 2006 MacBook laptop that's been happily connected to VLAN1 (untagged) and VLAN4 (Tagged) for several months now, since I wanted it to be accessible from both networks. It's easy enough to find the same ability in Windows (I just haven't really used it there.)
Most "enterprise" WiFi will (or can) assign a SSID to a VLAN. Fancier/newer implementations will (or can) assign a VLAN when a user signs into the RADIUS server (so two users on the same SSID could be assigned to different VLANs depending on their sign-in credentials.) Whether or not you make use of dynamic VLANs, using a RADIUS server (WPA2 enterprise) makes it much harder for "students" to get access to the "faculty" network, and also lets you know which faculty to have a little chat with if they do, since each user has a unique password, rather than "anyone who knows TheSecret123FacultyPa55w0rd can get on the faculty network."
In a normal install, you assign wired end-use ports to one VLAN and untag them (the old-fashioned approach.) APs get ports tagged with the VLANs that the SSIDs are assigned to, or that are the various dynamic VLANs users will be assigned to. Trunks between switches are tagged.