You can connect a L2 switch to the Ethernet port of the RAP3.
First you need to configure a wired AP profile in which you specify what VLAN you want to use (access or trunk mode) and the forwarding mode (this should be set to tunnel since you want to tunnel back the traffic to the hq).
If you have the wired AP profile you need to assign this to the remote ap group's configuration and enable the interface. You can do this in AP configuration - edit the required group - AP - Ethernet interface 1 port configuration (make sure the Shut down? is unchecked to enable the interface)
The 802.1q depends wheter or not you want to use the RAP's Ethernet port as a trunk interface. If you use access mode then you should configure the L2 switch port to access mode, too. The simpliest way is to use the RAP interface as access port and set the access mode vlan (in the wired ap profile) to the same vlan id which is used for the Voip server.