The easiest way to do this is to have a VLAN where the firewall is the default gateway and put that on the controller.
For example, if I have a cable modem or DSL circuit that you have a router/firewall connected to, that router has an internal DHCP server for clients. Connect that VLAN with the router's internal DHCP server to the controller as VLAN 409. When the users come in on VLAN 409, the controller will place them on that VLAN and their default gateway will be the router on that circuit.