The physical switch, to which the ESXi host physical NICs are cabled will do the tagging/untagging of the layer-2 frames. The physical switch port will need to be configured as an access port for this to work. One of the major drawbacks to this type of implementation is that the entire vSwitch (all the port groups on it) will only handle traffic from a single layer-2 subnet:

In EST mode, when a virtual machine's layer-2 frame enters the vSwitch, it hits an active uplink, which then carries the frame onto the physical switch. The physical switch's access port will then assign a VLAN ID to it and handle the traffic switching. When a frame tries to flow back into the vSwitch, the access port will untag the frame and send the traffic into the vSwitch, then back to the virtual machine's vNIC.