The only "multipoint" GRE from an AP standpoint happens in two scenarios:
- AOS8 with Clustering
- AOS8 with MultiZone
In these two scenarios, the APs will build multiple GRE tunnels to multiple controllers.
In the case of clustering, it is an Active/Standby User Anchor Controller (UAC) tunnel. This is handled automatically by the clustering mechanism.
To separate user traffic into a DMZ, Multizone would be the way to go to
Check out the following two videos as a starting point:
https://www.youtube.com/watch?v=tnw-JI6AnWA
https://community.arubanetworks.com/t5/Video/What-is-MultiZone/ta-p/298349
Please note, that for both deployments you need AOS8 with the Aruba Mobility Master.