You also need to check Protect Valid Stations
Valid client involves disconnecting that client if it is associated to a non-valid AP.
So be sure you see all your aruba APs as valid clients
Whati told you before just detect them but does not prevent from anything, this should do what you need.
Please enable it and try
As best practice you should not use default for this config... you should create a new profile, becasue if something goes wrong you just put the default profile again.
Cheers
Carlos