You are correct.
You would need a seperate SSID profile that uses WPA2-Enterprise instead of WPA2-PSK (that you currently have). The setting in the Aruba Controller's SSID profile of just 'WPA2' would indicate a WPA2-Enterprise network driven in the background using 802.1x.
The "SSID PROFILE" is what is used to set which mode (pre-shared or dynamic) credentials are to be used...in a given WLAN network (SSID) therefore it's one or the other...not both simultaneously.
When conversions like this happen its common to run the old service and the new service in parallel. I would recommend the use of Airwave then to run reports per-SSID to see how the users are 'migrating' naturally over to the new network.
JF