It depends on the how you route the traffic at the AP side, but normally that's the way things work. By default data traffic does not pass through the ZD unless instructed to do so. Authentication is usually done via ZD. It can be done at AP, but usually not.
So you can go ahead and tell your client all systems are go.