I given up. My own solution:
I’ve bought a small tp-link router TL-WR902AC. This has 1 ETH NIC, a UBS power connector and 2,4 GHz and 5GHz AP-Mode. The USB-Port of my firewall is the power supply und the NIC ist assigned/connected to blue net. And is even cheaper than the USB stick.