I always / always recommend
1) a seperate AP group for the internal AP on the 651 controller from the other APs in the deployment .
Why? That way the configuration of that internal AP is deterministic and you don't have to be careful/mindful of any settings that you meant to apply in the broader deployment.
2) never modify any profile that has the word 'default' in it... instead make 'new' profiles for all APs, and seperate profiles on the internal AP vs. non-internal APs. That way you (again) avoid any 'whoops we just turned on/off something on the internal AP that we only meant for the other APs.
This approach has served me...and many others well...