This is more of an academic question.
I'm setting up a new Guest WiFi at my office and using APXs managed by SC and it seems to be working. I have it set to NAT rather than Bridged, but I'm puzzled by how it gets through the XGS. The APX's DHCP Server hands a client an address, and I don't see that address (or network) in the gateway anywhere, but clients can get out to the internet, so it must be going through the gateway ... somewhere.
Does it use some sort of VLAN but hidden from admins to isolate the traffic? Would any XGS firewall rules apply?