TL-WA801ND don't have management VLAN, the packet from device itself is untagged. And if the TL-WA801ND receives packet from different VLAN, it would transfer to the right VLAN. But not itself, so you cannot configure trunk port for 801ND then you also want to manage it.

What would you suggest then? If I untag the (management VLAN) packets on egress from the switch will that solve the problem?

It works as designed... Which is a fail.

You can only manage the AP you are connected to - But through every SSID - If your client has an IP on the same subnet as the AP.
Management traffic from the wired side is untagged and there is no feature (which is needed and missing!) to select a vlan for management to get it tagged.
So if you just do nothing but drop untagged traffic on your network. No management will ever work from the wired side and even the AP will never reach a timeserver...

TP Link needs to implement the selection of a vlan for management.
Thats it... Everything else would just be a workaround for their own mistake.

That's a damn shame... any way we can put pressure on them?

My two AP500 have the same problem and as i bought them (end of march 16) the Multi SSID feature was unusable (other forum thread) with firmware AP500_V1_151124 (from 24/11/15...).
They still run on a beta firmware for two month now and on the website is no new firmware with a fix avaliable.

I also addressed the management vlan problem in my ticket but for tp-link it was more like a suggestion and not a missing feature.
If you count the month i use a beta firmware and add the ones it took for understanding the multi ssid issue on tp-link side and creating the beta firmware - It was not fast at all...
So no - I don´t think so. We might be lucky to get a firmware with that feature - Or maybe not...

PS: Looks like this feature would not been added in the second half of this year...