Bridging em and vlan

All of my devices until now have been behind my OpenBSD NAT router, but I
recently acquired a Internet of Trash device that I would like to be
accessible to the internet (yes, I know).

My home configuration uses a Unifi AP to translate my various SSIDs into
VLANs which plug into one of my APU em(4) ports. The IoT thing already has
its own dedicated SSID/VLAN, but doesn't enjoy living behind my NAT.

Is there a way for me to bridge just one of the vlan(4) logical interfaces
with my other em(4) uplink, so that my IoT item can speak DHCP directly
with my internet provider?

Can this be done with veb/vport or bridge, or will I need to use something
more exotic to strip the 802.1q tags before they are sent to my ISP?

Thanks in advance,

--david