Hello.
Based on my experience configuring IAPs and switches, the management VLAN is untagged (native for Cisco switches, PVID for most others). The additional VLANs are tagged.
On my switch (Aruba 2920), the ports for the IAPs are untagged for VLAN 10 (my management network) and tagged for VLAN 11 (internal/employee) and 13 (guest).
In Aruba Central, I configured the VC (System/General) with the static IP address, mask, and gateway I wanted for the IAP, and VLAN 10 as the VC VLAN. For each IAP, I have also set the VLAN to 10 for uplink management for each IAP.
For each WLAN, I've set the VLAN to static, with VLAN 11 for employee and 13 for guest. I could also use ClearPass or another RADIUS server to set the VLAN for the user, based on RADIUS response (Dynamic) or rules I create for the WLAN.
But the short version is that the management VLAN is untagged, and any specific VLANs for ESSIDs will be tagged.