Croatian Telekom config aka multiple VLANs in and passthrough

[dalu]

I made a previous post in the VPN forum but that's not where it belongs and now I have new info and am on site.

topology
desired:
- raisecom fiber ONT (aka modem-like)
- apu2c4 box 3 LAN ports with opnsense 22.1 on it.
- speeport plus, which also has a rj11 telephone jack

The ONT has multiple VLANs available.
VLAN 100 - Internet v4
VLAN 101 - VOIP
VLAN 103 - TR069
VLAN 1500 - IPTV with a dedicated 10.* IP range

In order to establish a connection one has to create a pppoe client bound to WAN (port 0) VLAN 100.
I have yet to try this, previously I tried with only the WAN igb0 and it didn't work, but I'm confident it will work when attached to ibg0-vlan100.

Now why do I want the opnsense box there?
2 reasons,
- site to site VPN
- having access to IPTV between 2 countries via proprietary set top box.

Now my question regarding network setup in opnsense;
For starters I'd like everything passed to the speedport plus box so operation can continue as normal.
I have created all the VLANs on igb0 (WAN), I assume I'll have to do the same on LAN.
Do I have to create a bridge between WAN and LAN?
Do I have to create a bridge between all the WAN VLANs?
How do I configure this?

Alterative:
Everything coming from the ONT should be passed to LAN except VLAN 1500 IPTV, which should be passed on OPT (igb2).
I would connect the STB to OPT and the speedport router to LAN.
(And later I would create a wireguard connection for the IPTV network)