With setting up the ER the way that I mentioned, you shouldn't need to mess with any relays (the ER is already handling DNS / DHCP for that secondary VLAN).
If you want to use the "guest isolation" and portal features of UniFi, yes you'll need to keep the controller running. A UC-CK is a great low-power device for this. If you've already got a controller somewhere else (e.g. AWS, etc.) then that'll work perfectly fine too.
If you don't want to use those features (and just rely on the VLAN firewalls), there's no need to have the controller running after the initial AP setup.