Radius Authentication Directly to NPS Server

unknown

Hi there, we've got a scenario where multiple sites have ZoneFlex APs deployed that are controlled by a single ZoneDirector at the central office.  User's authenticate to a WLAN via Radius to a Microsoft NPS server.  I am curious if it is possible to configure the WLAN such that those authentication requests do not proxy through the zone director but directly to the NPS server (or even better a pool of servers).  The concern with a single controller is that if the WAN link were to go down, user's wouldn't be able to join the WLAN.  As I am typing this, i also seem to recall that ZD controlled APs wouldn't function if they lose connectivity to their controller would they so the point might be mute?  Can anyone confirm this, or provide alternative recommendations short of deploying a controller at the remote site(s).  We also employ a vSZ-H to deliver wifi-as-a-service and those APs aren't as reliant on controller connectivity.