First, yes only the vlans in the vlan list in bridged mode will pass to/from the SM ethernet port. Management vlan is only accessible from the AP side unless you add the vlan to the list and use a vlan aware device on the SM ethernet port.
Second, Nat mode is like router mode with IP masquerading (like a home wifi router). To setup nat mode, you need to setup a few things: management vlan, data vlan, if your not using dhcp (for whatever reason) then you must setup your management IP and your device IP. We use dhcp for both on separate vlans to hand out different ranges to each vlan. One thing you must make sure of is that you do not use 192.168.x.x on the data vlan, that is on the client side of the SM and will not work correctly. Use 10.1.x.x. on the data vlan and 172.16.x.x for management (for testing of course, use real IPs for the data vlan unless you plan a CGN setup, then you need to use the 100.x.x.x addresses for that purpose)
Your switch must be setup as all ports trunked and cnMaestro needs to be told which vlan it is to use, set it to your management vlan. In the AP set the cnMaestro address and key, then select the zero touch option to enabled. This will force the SM to use the same cnMaestro as the AP.