Wireless LAN controller

Second scenario.

A centralized WLC uses a link aggregation group toward the core, and lightweight APs connect to access switches.

With centrally switched split MAC APs, should their access switch ports carry every client VLAN as trunks or use standard access ports?

Standard access ports in this setup.

That tunnel travels over the AP's local IP address.

The access switch port only needs to pass the AP's management VLAN.

The WLC itself connects to an 802.1Q trunk or lag bundle where those individual VLANs break out.

So, pair Edge PortFast with appropriate BPDU protection and identify where wireless client traffic actually leaves its tunnel.