The ingress network is not ment to be used directly.
Like I already wrote: the default a published port will implicitly use the ingress network. This behavior is what what gave you the impression of #2. Routing mesh is only available for published ingress ports. You can specify a published port to bind the port on the host it is running on directly, though this will require the long syntax for port publishing.
By default services in an overlay networks use a virtual ip, which forwards traffic to the replica instances. I am quite confident, that the routing mesh does nothing more than binding a published port on all nodes and forward the traffic to the vip, which again forward traffic to the replicas.