What software version is your CSS?
My CSS106-5G-1S is version 2.8 and is configured quite different than yours. The SFP is a gigabit link from this switch to a CSS326-24G-2S in my family room. It is exclusively a tagged trunk port. The two Open Mesh ports are WiFi access points that have both a non-tagged VLAN for cloud management connectivity, and multiple VLANs that each become a different SSID on the WiFi. Ports 3 - 5 are untagged ports to end devices.