1) without knowing exactly branch and model of the switch, i cant help you, because theres a lot of ways to do this!
a) Bypass C-TAG is a term that only applies to your switch
b) Port Isolation o Private VLAN is a technique to applies to a given switch port, in wich that port can only comunicate with a single "uplink".
c) 1q, or dot1q or 802.1q is the tagging protocol that makes real the vlans, wich means a 1q port is a port wich is part of a vlan, and can be tag or untagged, but mostly reffers to a tag port.
A workstation initiate traffic and send it to Switch 1. From the workstation, no packet is tagged in any way. Suppose the workstation is in VLAN 10 and that VLAN dont is default VLAN.
Switch 1 receive traffic and decide to send to switch 2, and insert the dot1q tag to the frame, indicates that frame belong to VLAN 10.
Switch 2 receives the Packet and if the port have various vlans (like cisco trunk o tag port with multiple vlans), then read the frame and then send it to the router in wich case this last port, must be a trunk (cisco) or tag port.
The Router receives the frame, read the frame and send it to another interface o subinterface depending the destiny of the frame.
Later, the router receives the repply, and add the tag (VLAN10) to the frame, and send it to switch 2.
Switch 2, reads the frame, and send to switch, without removing the tag.
Switch1 receives the frame, remove the tag and send to the workstation.
If the frame have the tag, and need to send it to another switch trough a trunk port or tag port, then do not remove the tag, just read it and send the frame.
hope helps! :)