Are you managing the APs manually or are they managed by a central controller?
If they're managed with a controller (like a UniFi Controller), your switch ports only need to be configured with whatever VLAN ID you use for the AP's management interface (to uplink to the controller). The VLAN IDs used by the SSIDs are encapsulated in a sort of tunnel (LWAPP or CAPWAP), so the switches will have no knowledge of those tags. You would just need the controller to be on a trunk interface so it can communicate on each VLAN ID as needed.
If you're managing the APs manually (you log into each one to configure the APs directly), then yes, you will need to have the switch ports in trunk mode, and allow whichever VLAN IDs you use for each of the SSIDs.
As for restricting access for the guest network, most controllers (if you're using one) have an ability to tag an SSID as a "guest" network, which most often automatically limits it to just internet access. If not, or if you don't have a controller, you can always add an ACL to filter out any undesired networks. For example, if you're only using IPv4, you could filter out all of the networks defined by RFC 1918. An example of an ACL might look like:
access-list from_guest extended deny ip any 10.0.0.0 255.0.0.0
access-list from_guest extended deny ip any 172.16.0.0 255.240.0.0
access-list from_guest extended deny ip any 192.168.0.0 255.255.0.0
access-list from_guest extended permit ip any any
This would filter out all of the IPv4 private network ranges but allow everything else (like any public IPv4 networks).