Ah so I am not alone in this problem!
When using VLANs and the SM in NAT mode, the SM can only be accessed from the ethernet using the management VLAN.
Unfortunately this is quite broken. I tested this back in 2009 (http://community.cambiumnetworks.com/t5/Other-PMP-Solutions/VLANs-NAT-DHCP/m-p/28929?collapse_discussion=true&filter=location&location=category:forums_pmp&page=2&q=management%20nat&search_type=thread) and again now with 15.1 and 16.0.0.1 and this issue still persists :(
Is the implication here that the only way to locally manage a NAT SM is to not have VLANs at all? I had assumed this was some RADIUS-specific issue.