Sophos RED in "Standard/Split" seems to be tunneling all traffic

I have a Sophos RED configured with a managed switch behind it. I had gotten this working as I wanted with "Standard/Unified" and a single tagged port on the LAN interface of the RED. 

I was able to access internet and resources behind firewall and could test out firewall rules and see them working.

I have now been asked to change this to "Standard/Split" believing that this would allow users behind the RED to 'directly' access the Internet through their local ISP for speed purposes.

Based on this documentation I was assuming that my vLAN tagging on the LAN interface would break Internet and 'behind the firewall' access once I moved to "Standard/Split".

I updated the settings for the RED and was able to successfully save the change on the firewall.  I lost several pings from the user behind the RED to a resource behind the firewall, but the connection came back up and everything seems to be operation as before, including the fact that traffic to WWW resources are being routed out the firewall. I'm validating this by doing traceroutes and googling "what's my IP address".

At this point the only change I've made to the configuration is to convert the RED operation mode, and specify the Split Networks. From the Firewall management interface the RED port still has the VLAN tags on it, and the connected switch has had no changes. 

Question 1: Am I misunderstanding what Standard/Split does regarding direct access to the Internet?

Question 2: Do I need to further dismantle my previous settings on the RED before the Split function begins working?

Devices involved: SD-RED60
Sophos Firewall running: (SFOS 19.0.0 GA-Build317)