If you can't change the bridge forwarding mode, one option is to use IAPs rather than RAPs. If you setup IAPs at these sites and then utilize the IAP-VPN functionality for HQ connectivity (if required) rather than a traditional controller-based RAP, you could have the bandwidth controls you are seeking at that site.
Alternatively, you could consider a 7005 controller which coud serve the APs at the branch for a traditional controller-based architecture.