When you're configuring access point groups, click on your user name on the upper right hand corner, select preferences and enable "Show Advanced Profiles".
Now you will have Profiles settings in the APG menu, from there you can configure AP --> Ethernet Interface 1 --> Wired AP. Create a profile with Tunneled mode, and set an access VLAN for example 300. If you have this VLAN 300 configured on the controller traffic will be tunneled there.
We're just getting this set up. If anyone has tips how to dynamically configure this with 802.1X I'd like to know. Is it just applying an AAA profile that dynamically assigns the VLANs? Wonder how the roles work with this kind of setup