Mike_5525 wrote

Assumptions:

-best if 1 device can handle router + WiFi + VPN Client

Omada EAPs are just APs. You have to use a separate router which also handles VPN.

- 2 SSID (employees/guests)

No problem. EAP225 supports up to 8 SSIDs per frequency band (16 total).

-one captive portal/management portal

-branches are located in different cities and I would like to solve the problem with managing WiFi

You can use Omada Controller software for this. Just set up a server which can be reached from every branch (i.e. has either a public IP or can be reached through a VPN). This way, you do not need an OC200 hardware controller at every branch.