Hi,
The short answer to the question is no. It is not possible.
The RAP forms an ipsec tunnel to the controller, within which separate GRE tunnel are formed for the enet1, enet2... port if they are present and configured. Separate GRE tunnels will be formed for every bssid. These GRE tunnels are for the RAP users that are connected to the RAP enet1, enet2... ports and the RAP bssids. Here the phone cannot become a RAP user and the traffice from the phone cannot hit any of the tunnels.
You would need a different RAP with additional enet ports for the requirement.