I need to indicate a correction here. Right now, we need to configure the RADIUS server to allow all APs individually or a rule must allow the entire subnet. But, we are constantly looking to enhance the solution (with software updates) to make it simpler for the user.
With latest SW version, you are able to configure IP address from which RADIUS communication will be initiated - so on you RADIUS server, you just need to add one IP fo whole cluster of APs.
I have yet to deploy an Instant On. Does it not have a virtual controller IP like the Aruba Instant? I'll be receiving my test devices this week so I'm curious.