If you have a controller the IAP can send traffic back to the controller via an IAP-VPN connection. Alternatively the IAP-203H can be converted to a remote AP and send traffick back to a controller, as well. The difference is that the IAP-VPN AP can operate independently of the controller, while the IAP-203H converted to a remote AP depends on a hardware controller for configuration and monitoring.
The IAP-203h cannot form a VPN tunnel with another instant cluster, however.