Hi!
I have a similar hardware config - 1 RB3011 and 2x CAP ACs. Here is what I did to have separate SSIDs.
Go to CAPSMAN config and start from right to left:
1) Create 1 security config to define your wifi secret
2) Create 1 datapath that suits your needs
3) Create 2 Channel configs
Config 1 - whatever name you like - select 5ghz-n/ac
Config 2 - whatever name you like - select 2ghz-g/n ( or only n, depends on your needs)

4) Create 2 "Configurations"
Config 1 - put a SSID for the 5Ghz network (example netis5ghz) - select items from points 1-3 (security, datapath, channel) but choose the channel related to 5ghz (config 1 from pct3)
Config 2 - put a SSID for the 2Ghz network (example netis2ghz) - select items from points 1-3 but choose the channel related to 2ghz (config 2 from pct3)

5) Create 2 provisioning rules - this is where the magic happens - you can make CAPSMAN assign SSIDs based on radio capabilities. The CAP ACs have 2 built in radios, 1 in 2Ghz band and 1 in 5Ghz band. Capsman can provision the 5Ghz configuration from pct 4 on the 5ghz radio and the 2ghz configuration on the 2ghz radio which will basically create your 2 SSIDs.
a) Rule1 - for 5Ghz
go under "Hw. Supported Modes" and select "ac" and "an" and choose pct 4-config 1 under master configuration. Also under action select "create dynamic enabled"
b) Rule 2 - for 2ghz
under hw supported modes select "gn", select the other config from pct4-config 2 and crate dynamic enabled.

And that's it. Once both CAP ACs register with capsman you will see 4 dynamic interfaces automatically created ( 2 from CAP AC 1 - 1 for 5ghz and 1 for 2ghz, and 2 from CAP AC2) and 2 SSIDs.

Forgot to add:
1) do not create any manual CAP interfaces, they will be created automatically by the provisioning rules
2) you should look into creating WIFI access lists in capsman. these are needed because most devices will hang on to the first connected AP even though they moved and AP2 has a better signal. To go around this you need 2 rules - first one allows connectivity until a certain power level, let's say -75dbm, and the other one rejects any client with lower power than -76. this basically kicks the client from ap1 and will automatically reregister to ap2. the threshold value is something you must choose depending on your local setup.