AP Controller will wait for management connections originating from APs over the LAN on TCP and UDP port 11753. It will also wait for captive portal connections on TCP port 443. An extended DHCP option “CAPWAP Access Controller addresses” (field 138) will be added to the DHCP server. A local DNS record “wlancontroller” will added to the local DNS proxy.
If you would only like certain APs to be managed you would choose “Approved List” under Permitted AP and this would tell the AP Controller to only manage the devices that are in the approved list (which is by serial number) as by default it will manage all APs that are reporting to it.