Your description of what you want is a little odd, but let's go with that. I don't really understand what you mean by having one port as Management, but another port that is a Management VLAN that spans all ports.
I have posted a couple of screen captures of my CSS106. I included a link to the photos in addition to the capture because the source is not a secure website and recent versions of Google Chrome will not imbed an image from a non-secure website into a secure webpage (and this forum is secured).
I'm going to describe what I am using this switch for, and you can see how I have it configured. Ports 1 & 2 are WiFi access points that use an untagged port for online configuration, and each SSID is mapped to one VLAN. I am sending every VLAN that MIGHT be used on that access point, and let the AP decide which ones to do anything with depending on the configuration of the AP. You can see that there is one VLAN on each on that is set to "Always strip" to provide that AP with the required untagged access for configuration. Each of the APs was actually only using four SSIDs and therefore four VLANs in addition to the untagged LAN.
Ports 3, 4, & 5 are plain untagged devices so the VLAN for those is set to "always strip" for the one VLAN used for those devices.
Port 6 (the SFP) is a trunk to the upstream switch. The trunk port to the firewall is the easiest part. Add all the VLANs to the trunk port. On the VLAN tab, the trunk is set to "only tagged" and Egress is set to "add if missing". My opinion is that the trunk should be all VLAN tagged and not a hybrid.
Management access can be limited on the System tab.
The upstream switch (in my case a CSS326) is set similar. Since you will be having the RB260GS connected to a hAP AC2, the trunk port on the router will need to be set up so that whatever VLANs are needed on the switch will be there. I assume you will have that as part of a bridge and I have never set up a bridge in RouterOS, so I can't help you with that part of the configuration.
http://extraphotos.info/mikrotik/CSS106-System.PNG
http://extraphotos.info/mikrotik/CSS106-VLAN.PNG
http://extraphotos.info/mikrotik/CSS106-VLANs.PNG