I did some sniffing on the Wifi interface without IP address.
Turns out that the interface doesn’t receive any packages at all, not even ARP replies, if there is no IP configuration active. If I assign some static fake IP without a gateway that is not on the Wifi DHCP subnet, the bridge is working fine and the VM can acquire a DHCP address through the TAP interface and access the internet as well.
So functionality-wise this is pretty much what I want, but even though irrelevant on the local host, the fake IP on the Wifi interface could cause collisions if multiple hosts on the same subnet are using this technique.
I understand that Wifi cards resp. drivers do not support promiscuous mode, but I would still expect the interface to receive ARP replies even if there is no IP config. Is there any way to trigger this?