To my understanding, the template data/templates/firewall/nftables.tmpl is probably the culprit, as it doesn't check whether group_conf.address (and similarly the others) has any elements at all and introduces the offending white-space:

{% if group is defined %}
{%   if group.address_group is defined %}
{%     for group_name, group_conf in group.address_group.items() %}
define A_{{ group_name }} = {
    {{ group_conf.address | join(",") }}
}
{%     endfor %}

I'm not a templating master, but I would assume it should be possible to filter out zero-length arrays with something like this:

*Edit*: obviously, it was too late for me to be able to count correctly. It should be {% if group_conf.address|length > 0 %}

{% if group is defined %}
{%   if group.address_group is defined %}
{%     for group_name, group_conf in group.address_group.items() %}
define A_{{ group_name }} = { {% if group_conf.address|length > 0 %}
    {{ group_conf.address | join(",") }}
{%       endif %} }
{%     endfor %}

I just realize it's getting more complicated as python/vyos/firewall.py will later write out the rules for these empty groups and when reading-them in, nftables will complain (again) when trying to resolve them, e.g.

define A_PRINT_SERVERS = {  }
...
table ip filter {
    chain GUEST-LAN {
        ct state {established,related} counter return comment "GUEST-LAN-1"
        ct state {invalid} log counter drop comment "GUEST-LAN-2"
        meta l4proto tcp ip daddr $A_PRINT_SERVERS tcp dport $P_PRINTER_PORTS_ALLOWED counter return comment "GUEST-LAN-1010" 
        counter  drop comment "GUEST-LAN default-action drop"
    }
...
}

will result in

/run/nftables.conf:14:26-29: Error: Set is empty
define A_PRINT_SERVERS = {  }
                         ^^^^

The CLI doesn't catch that (and didn't so in the past either: presently, it's possible to configure such rules without any difficulties when running VyOS under earlier releases with the old iptables code).

Arguably, the original issue is a pure “syntax” problem (i.e., the generated file is not valid at all when the format of the empty set is not correct) which can and probably should be fixed?

See comment in T4164: my config runs through easily now.