If your objective is to be able to survive configuration mistakes, this can only be done if you have completelly separated management and production environments.
Here, management of the switch will continue no matter what happens with the production network (green).
If you connect the management network to the switch you will be, probably, propagating it back to the core through the same uplink as the production networks. Any problem with the production networks (either you misconfigured the switch and broke that link, or you created a broadcast storm that completely saturates it) and you'll lose management of the switch.
If the switch is in a remote site, there's no way of having separate links back to HQ, but you can still have separate networks connecting to the router.
Finally, from a security standpoint, an isolated management network will protect you from attacks originating from the production
Connecting the management port to the same switch is the same as managing it inband through one of the user-side networks, but comes with some side effects. So, why bother? Create an administration vlan in vr-Default and exclude regular users from it.