Each port can be be elected for one role depending on the topology:
Roles:
Root port
Designated port.
Alternate port.
Backup port.

For a given port to be elected in one of the roles it passes through different states:

States:
Discarding
Learning
Forwarding

Take a look at this animation :

http://www.cisco.com/warp/public/473/spanning_tree1.swf

frame 10: After the election of a root bridge, each non-root bridges must elect one of its ports as a RP (root-port) the closest to the root bridge.
Then a designated and non-designated port are elected for each segment.
Frame 12,14,17,18,20: designated ports are elected, others are in blocking or forwarding state. During all other frames, BPDU is exchanged and each time a port receives TCN (Topology Change Notification) or enabled it passes through (Discarding, Learning, Forwarding) before stabilizing in a given role.

I hope this clarifies the conceptual difference between states and roles.

I believe there is no “stateful” version of NAT NVI, but you still can deploy traditional NAT in each customer VRF with HSRP (which is resumed to the outside as simple gratuitous arp message that will direct the downstream to the active HSRP)

I think the more appropriate design would be “Customer VRFs & Common service global RIB + Traditional NAT” + HSRP deployment.