How to locate controller for Unifi behind NAT?

Question

WiFi

There are many Unifi APs at different sites.
All NAT clients are organized by Mikrotik.
I really want to collect these points in one controller (breaking them into subsites). But as far as I know, the point and the controller do not want to be friends as a standard if they are in different subgrids.
Where is the best place to dig?
There are thoughts on:
1. STUN organization
2. VPN from the client's locale and using aliases on the host with the controller
3. VLAN (but it hasn't taken off yet)

Answer 1

In my networks, I use DHCP with option 43.
Here it is written about it:
wiki.ubnt.com/UniFi_FAQ I
also recommend turning clients into VLANs and forbidding access to the management subnet with a firewall.

Answer 2

EoIP as an option

Answer 3

Unifi access points can safely work on L3. See how it's done in the video example .

Answer 4

Article with all the ways:
https://help.ubnt.com/hc/en-us/articles/204909754-...