Wireless Access

We are already using the two ehternet ports on our 7220 and wondered if I can add a switch with trunk ports to provide more connectivity options?  Alternatively, I assume I could use media converters in the fibre ports?

You can certainly connect the 7220 to a switch for additional trunked ports, however the 7220 does have Four 10GBASE-X (SFP+) ports (ports 2, 3, 4, and 5), these ports are intended for use with Aruba supported SFPs. The 7220 also has Two Dual-Media Ports (ports 0 and 1). 

What is your intended usage of the additional ports and what is the current usage of the configured ports?

I think he is trying to do what we are doing in my environment. We have 3 7240XMs in 1 data center and 2 7240XM in another. In our primary data center we combined all 4 10gig ports into a port channel and uplink to a Cisco 3850. All vlans ride the 40 gig port-channel. From the switch we have multiple uplinks to various points in the network carrying different vlan to that part. Also for our guest we have a vrf deciated to guest users routing off the 3850 into another switch with our DMZ. Doing this type of model allows use to route all wireless traffic of the L3 switch directly connected to the controller.

We run a number of external services; a guest network and eduroam, both of which use pbr into 2 seperate dmz's, but we now need a third.  

I envisaged connecting either a 2960x or 3850 to a fibre port and trunking the relevant vlans carrying the above services which would then connect into their respective DMZs.

Sounds like it is possible looking at what apkeene has done.

Never bothered using Aruba SFP's and had no issues with the ones we are using...

Yup it is possible. I offload the routing on the L3 switch. So uplink the controller to L3 switch and only pass the vlans to the controllers. VRF out the different connection on the L3 switch if possible.