You can only choose a switch port on one interface as you found. If you leave unset it will use the actual VLAN status which takes it's state from the parent interface. In this case though that's the in internal port which is always UP.
No, there's no private VLAN type function. That would need to be on a switch where hosts are connected directly.