I will answer the first part by myself:
Yes, by default, managers are workers also. But you can tell to manager to stop acting worker on this way:
docker node update — availability drain manager_name
IMHO, this should be case in every production like system.
The rest of this port remain unsolved. How to make swarm services to talk to outside world (Consul Agents, Logstash, RabbitMQ, ELK)…