Layer 2 means the user gateways are upstream in a switch/router and the controller is dot1q trunked (or access if single VLANs) to the upstream switch.
Layer 3 means the controller holds the L3 gateways and usually routing is in use.
Layer 2 is the most popular design.