If clients get 172.31 and your SSID is configured as "Virtual Controller Assigned", client traffic would be natted out of the ip address of the Virtual Controller. If the Virtual Controller can get out, the clients should be able to get out if the "Access Control" tab is "unrestricted".