Small confusion, I misread the post.
Tim is correct, you must attach an AP to a controller in order to provision it.
You can add the whitelist entries to the desired controller but the AP must be provisioned.
The only other way I see it is by purchasing IAPS, using activate to convert an IAP to a RAP after the IAP is plugged in and has internet access. You then whitelist the RAP into the correct AP-group and your AP is provisioned.