I have my capsman router trunked (tagged frames) to a CRS1xx swtich, do we want to connect the cap to access ports (untagged) for a cap with normal 'cap mode' (non tagged interface) configuration or a trunk?
When using "! local-forwarding", then as already indicated all traffic of wireless clients will be sent to CAPsMAN. It will be set over the very same transport channel as it's used for CAP-to-CAPsMAN management connection (i.e. over which CAPsMAN provisions CAP). And that leaves creating that transport channel entirely to CAP/CAPsMAN administrator.
To be concrete: if you have on CAPsMAN configured (say)
/caps-man manager add disabled=no interface=myVlan and
local-forwarding set to no in
/caps-man datapath, then property of same datapath entries
bridge applies to bridge name on CAPsMAN. At the same time you can have
/interface wireless cap set discovery-interfaces=<uplink_physical_interface> on CAP (or a VLAN interface, it doesn't matter) and if CAP can talk to CAPsMAN (so it can get provisioned), also traffic will get to CAPsMAN and only thing that can go wrong is wrongly set bridge property on CAPsMAN.
On the other hand, in "local-forwarding" case the rest of
/caps-man datapath settings don't matter much (except for vlan-id and vlan-mode), it's CAP setting
/interface wireless cap property
bridge that defines where provisioned wireless interfaces will attach (and deliver client's traffic). And it's again up to CAP administrator to properly set up mentioned bridge so that it'll be able to move traffic as desired. And from capsman (the provisioning process) it doesn't matter if it's trunk or access or whatever port, bridge needs to be properly configured.