Thanks for that information.
If you want a client to get an ip address local to the AP you would need:
- Control Plane Security Enabled
- A Virtual AP configured as "bridged"
- The VLAN that you want the client to be on trunked to every AP that SSID is connected to.
The switchports that those APs are connected to would need to be configured as trunks with the "default" or untagged VLAN as the VLAN the APs would get their ip addresses from. You would need to allow the VLAN that the clients need to be on, on those switchport trunks. Lastly, you would configure a bridged Virtual AP where the VLAN specified is the client VLAN allowed on those trunks.
Since you have a fiber connection between the APs and the controller and there should be no significant latency between the client and the server, most people would opt for the Tunneled Virtual AP and avoid having to configure switchports at a remote location.