Management VDOM configuration with transparent mode firewall

I have a 300D running 5.2.7 that I'm trying to configure primarily as a transparent firewall to protect a server room from the rest of the network (we're a university, so we basically have to treat the campus network as hostile as it's pretty open). I want to have a separate VDOM running in NAT mode to cover a few special servers, but for the most part I want to run in transparent mode.

I've read a number of different docs from Fortinet that say you should have the root VDOM running in NAT mode and have that handle management traffic only, then have a second transparent VDOM to handle user traffic. Unfortunately, I haven't found much describing exactly HOW to do this. I can either get the root NAT VDOM online, or the transparent server VDOM online, but not both.

I have an 802.3ad trunk coming in from campus (i.e. WAN) with a few VLANs on it, then a 802.3ad going out to the rack with a few more VLANs on it. The VLANs are all separated out into appropriate forward-domains (each forward-domain only has two interfaces in it, one for the campus side, one for internal). Ideally, I want all traffic, regardless of the destination VDOM to come in over that single WAN trunk. I have a feeling VDOM-links are the answer, but am running into issues with assigning IP addresses. I have the VDOM-link running in ethernet mode, but when I try to assign an IP to the NAT side, it complains that the IP is covered by an existing subnet.

So ultimately what I'm asking is two questions really. First, is there a guide that gives close to step by step instructions for something close to the scenario I described above. Alternatively, is there anything wrong with running both VDOMs in transparent mode?