B@AP means bridge at AP, this is exactly what happens, all the traffic is switched at layer 2 in the defined vlan, user data traffic is not tunnelled back to the controller, traffic egressing the AP will be placed into the defined vlan, after that it's up to the wired network to deliver the traffic to its destination and back (by conventional switch/route) If you define egress traffic as tagged in the AP config, then the AP expects to receive matching traffic tagged.
If you want to tunnel traffic to the controller so that it arrives at a central point, then use a bridge at controller topology (B@AC) - with this topology type, you would need to tag vlan traffic to the controller but not at the AP.
In summary:
B@AP traffic doesn't need to arrive at the controller tagged or untagged but does need to be tagged/untagged at the AP.
B@AC traffic doesn't need to arrive at the AP tagged or untagged, but does need to arrive at the controller tagged/untagged.
Choice of tagged or untagged is up to you. As previously stated only 1 vlan can be untagged.
Also note that you cannot add a L3 entity to a B@AP topology. The l3 entity (if required) must live elsewhere in the wired world, it's external to the controller/AP.