As usual, when you're trying to pass a comma as a character in an identifier it needs to be escaped:
$regex(guest12343,$+(/([0-9]){4,$chr(44),5}/))
Or assign the expression to a local variable:
var %r = /([0-9]){4,5}/
echo -a $regex(string,%r)
In this case though, you can just change the expression slightly to erradicate the need for a {} quantifier:
echo -a $regex(string,/(\d{4}\d?)/)
Which also answers your second question, enclosing the whole part that matches the full number in parentheses i.e. ([0-9]{4,5}) instead of ([0-9]){4,5} will make it capture the whole number rather than the first one matched