VPN Client - Blue vs Gold

Just received my Gold unit yesterday.  I migrated from Blue to Gold.  

Setup:

• Using Xfinity modem
• Using my own Linksys MR9600 setup in Automatic Configuration DHCP mode
• Firewalla Gold configured in Simple Experimental mode
• Using Firewall iOS app version 1.970 (935b49da) and I am in Beta Program
• I unpaired and removed Firewalla Blue device from my network after migrating to Gold
• I also rebooted Xfinity modem and Linksys router for extra measure
• Using ExpressVPN client configured and activated in Gold

Issue:

• When I was using the Blue, I simply changed my devices to the 192.168.218.x / 24 range to be in the overlay network.
• Then I went into VPN Client and selected devices to be protected under ExpressVPN
• In Gold those devices that were configured in the 192.168.218.x / 24 don't even show up in devices
• I set those devices back to automatic DHCP so they could have access to the internet
• The instructions in Gold are to Connect your devices to Ethernet Port 1,2,3, with an Ethernet cable or with wireless access point or a router that has been set to Bridge Mode/AP Mode
• I don't have a separate AP device

Question:

• How can I get my select devices (Kid's laptops) to be protected with the ExpressVPN client with Firewalla Gold?
• If I set my WiFi router to bridge mode, then I am assuming that all my connected devices will be protected under ExpressVPN client?  I only want select devices.  See note below.
• Do I need to do something special in the new Network section of the Gold?
• I currently only have 'WAN' which is set to DHCP on Port 4 and LAN, which is set to 192.168.74.1 / 24 on Port 1.
• What is equivalent to overlay in Blue to Network settings in Gold, if that matters?

Any help is appreciated.

Edit - I changed the internet option on my router from DHCP to Bridge Mode and this definitely did not help.  I did of course first change the Gold to DHCP mode before changing router to Bridge mode. After I did and connected to my normal WiFi, I had to internet access at all. So I started over...and reverted to configuration above.

Update - I had the cable connections wrong and sequence of install out of whack. Firewalla help desk (via email) recommended putting Firewalla into Router mode to leverage VPN features.

Here is the recommended sequence:

1. Switch Gold from Experimental simple mode to Router mode
2. Reboot the Modem
3. Connect Gold's Port 4 to the Modem's LAN Port. 
4. Connect your Router's WAN Port to the Gold's any other port (1, 2, or 3).
5. Switch Router to Bridge mode and Save. 

The SSID won't be changed. After the configurations are saved, you'll need to reconnect your device to the network (turn the WiFi off/on), in order to get an IP assigned by Gold.

I will try this later on today after everyone is off of network.