Hi there,
You could assign the Blue zone also to a LAN interface (see wiki.ipfire.org - Zone Configuration) (wiki.ipfire.org - Configuring three zones, using two NICs and one VLAN).
Than assign a VLAN on the switch ports you are using for the AP’s and to the Blue interface.
I did this myself.
Green - a lan interface
Blue - a WLAN interface and VLAN to Green
On the switch - Green interface port default lan and a VLAN for Blue
Switch ports for the Access Point VLAN for BLUE