You should start with making a good RF design, this can be done virtual as well with tools like ekahau or visualrf.
Security on controller based Wi-Fi is not better or worse then Instant, it is just a different deployment model.
You can choose a deployment model based on customer demands (tunneling needs, local breakout possibility, wired lan integration, cloud or on-prem management.
Such a small enviroment can usually be deployed with aruba instant.
Have you discussed ClearPass with the customer, since you are talking about security?