this is all based on the IEEE 802.1Q standard...
basic rules:
1) a port can be untagged in at most 1 vlan at a time
2) a port can be tagged in as many vlans as are in the switch config
an untagged port is what you normally connect an endpoint device (computer, printer, server, camera, badege reader, sometimes a VoIP phone, etc)...
a tagged port is used "mostly" to interconnect switches that carry multiple vlans on that link...
a tagged frame has an extra 4 bytes in the middle, which has the vlan id, qos settings, and a few other bits of data...
"normal" endpoint devices are not configured to speak tagged...altho there can be exceptions to this rule given very specific configuration/operation requirements (servers, VoIP phones, AP's)...but generally a user computer speaks untagged...
hth...jeff