The IP addresses of all controller interfaces will be permanently installed in the 'datapath user table'. So you don't need to be concerned about duplicate IP addresses (by end users). Obviously, the controller can't stop anybody from configuring a router with the same IP address.
For AP's IP address, our best practice would be to use a VLAN that is separate from any user VLAN. So the chance of IP conflict is small. Also, you can make use of the 'validuser' ACL to allow users to use IP address in a certain range. In addition, you can enable DHCP enforement in the relevant AAA profile such that controller will only install address that are given out by a DHCP server. I.e. users would be able to use static IP address.