you are using high freq. range external crystal so CLKSEL3..0 will be 1111 and it is better to configure the controller at 16k ck+ 64 ms start-up time so SUT will be 11.
so overall fuse byte will be higher byte=0xFF, lower byte = 0x89
If u want to disable the JTAG, the fuse byte will be higher byte=0xFF, lower byte = 0xC9.
In try these configurations. if u asre not able to program the controller the SPIEN might be disabled. this bit enable/disables the serial programing of the controller. to enable it parallel programmer is needed.