The words “untagged” and “tagged” cause a lot of confusion.
To untag a vlan on a port essential sets that vlan as the default. Every port has one and only one untagged assignment. Out of the box, every port is untagged vlan 1.
To tag a vlan on a port allows traffic on the vlan to pass through without being assigned the untagged vlan. Think of it as a whitelist. So you do this on connections between switches, routers or hypervisors where vlans have already been assigned to the traffic and multiple vlans are on a single port. “Trunk” ports are usually tagged with all vlans. Out of the box, no vlans are tagged on a port.
To exclude a vlan on a port means that any traffic attempting to use that vlan on that port will be reassigned to the untagged vlan. Out of the box, all vlans except vlan1 are excluded on a port.
Each port on a switch is either untagged, tagged or excluded for each vlan.
In your case, if ports 1 and 2 are untagged vlan20 and no other vlans are tagged on those ports, anything you plug into 1 and 2 will be vlan20 on that switch. So it makes sense that they can communicate with eachother.
If vlan20 doesn’t appear anywhere else on your switch, then they will only be able to communicate with each other.
If you want them to be on the same vlan and not communicate directly with each other, you need to configure port isolation or private vlans (both of which are imperfect solutions IMO).