Theres an initial step in the setup wizard where you get to chose whether you want to bridge all ports, or seperate control and data plane ports. I'm not entirely sure but I think Bridging all ports activates LAG and means only 1 IP is used for management and GRE tunneling.
Personally, when it comes to the network config details like ports, VLANs, etc. I find the documentation really confusing and unclear. When you want to tunnel an SSID you just check the tunnel box - but the VLAN part is no different than how an AP is expected to behave so you just need to make sure that VLAN is tagged from the connected switch to the SZ - nothing else on the SZ side to manage VLANs, just one management IP, untagged, and off you go.
