Need help with setup of Wi-Fi & VPN TZ270W

I have been unsuccessful in getting everything I want to work at the same time. Maybe it is impossible, but I would like some advice to see what can be done. We have a TZ270W. Our needs/wants:

1. VPN access for employees at home or in the field can have access to our server on the LAN.
2. Wi-Fi access within our building to access the Internet and the LAN.
3. Guest Wi-Fi to access the Internet and block access to the LAN.

The setup I have attempted:

1. L2TP VPN
2. WLAN (w0) bridged to the LAN (x0)
3. VLAN as a subnet of w0 for use as the Guest Wi-Fi
4. We have 2 site-to-site VPNs to allow access to a cloud server and IT support

Now the issues:

1. The only change I make is to the WLAN interface. All policies, objects, etc. stay the same.
2. If I have the setup as above, WLAN has LAN access, Guest does not, but the VPN cannot access the LAN. Unable to ping any internal IP addresses from the VPN.
3. If I don't bridge the WLAN to the LAN, the VPN gains access to the LAN, but the WLAN loses access. Unable to ping any internal IP addresses.

Any suggestions? The reason we got the W model was to keep the setup simple as we don't have a large staff or budget to manage IT issues (to get rid of the IT company and the need for the site-to-sites).