You may consider just using the IAPs to handle your clients and do without the RAP-5s. The virtual controller of the IAP can then VPN back to your office location; removing the need for the RAP-5 in your case. Review the VPN Configuration chapter in the IAP User Guide to see if it will provide you with what you need.
High level summary from the guide:
The IAP supports termination of a VPN tunnel on the Aruba controller. VPN features are ideal for:
- enterprises with many branches that do not have a dedicated VPN connection to the corporate office.
- branch offices that require multiple APs.
- individuals working from home, connecting to the VPN.
This new architecture and form factor seamlessly adds the survivability feature of Instant APs with the VPN
connectivity of RAPs — providing corporate connectivity to non-corporates