Create a per-client PVID setting that pushes/pops the VLAN as appropriate. Client Spec should use negative VLAN ID to indicate PVID JSON spec should have a "pvid" key.