This connection between the remote access point and the controller may be via a tunnel, which may be encrypted or secured.
The controller may have a list of remote access points it is to support, and accept connections from and send configuration information to only those remote access points.