Hi Matt,
The reason behind not allowing access to the management interface when managment VLAN is enabled is for security. An SM is typically installed in a customer premise and it is meant to prevent the end customer from accessing the SM once the operator (you) has decided to seperate management traffic from regular user traffic using a management VLAN. We have heard from customers on both sides i.e. lock out the management interface form the SM's LAN side when mgmt VLAN is enabled as well as allowing access (which is your case). We implemented the more conservative scenario. Having said that, we are going to make an enhancement in a near future release where this will be made configurable from the SM GUI. You will be able to enable/disable management access from the SM's LAN side when management VLAN is enabled.
Lastly, regardless of the VLAN configuration, the management interface should be accessible through the Fallback IP of 169.254.1.1 from the LAN side of the SM. Hopefully that helps complete your configuration before connecting to an AP.
Thanks,
Sriram