The campus VRD talks about master-local but the configuration is the same for SSID, VAPs and other profiles expect that in your case you terminate the APs on the master instead of on the locals. As you would have seen in the VRD the VLAN and IP configuration is local to the controller and is not propagated from master to local.
In your case, you want your users to get IP from local DHCP server but when a VAP is in tunnel mode all the traffic including the DHCP requests are terminated on the controller. One this you can do is
1. Have connectivity from the master to the all the local DHCP servers and then configure different VAPs with appropriate local VLANs that the users should use and seperate AP groups for each buiding. Now, the guest VAP in building A will have the VLAN with DHCP helper IP that points to local DHCP server in building A. The guest VAP in building B will have the VLAN with DHCP helper IP that points to local DHCP server in building B and so on. This setup will cause the DHCP traffic to take a longer path. For instance the DHCP discover packet will travel from local building A ---> datacenter ---> local dhcp server in building A .
2. Another, thing you can do is deploy the guest WLAN in bridge mode and let the network routing take care of proper routing to the internet. However, with bridge mode you cannot use captive portal for guests. You can either use open SSID, 802.1X or PSK, which is not ideal for guest networks.
Hopefully, another Airheads Expert can provide a better solution.
Regards,
Sathya