HI John,
the nas port-type as virtual has nothing to do with the smartzone being a physical or virtual appliance. Its just what it does to create a "fake" test packet.
In all your first attempts you were not using proxy mode. As such, the APs themselves are sending the radius auth request and thus you need to add all the APs as radius clients on your NPS.
If you run in proxy mode, then its smartzone sending the requests. Are you able to run wireshark on your NPS server to see if any radius packets are reaching the controller at the IP level? I dont recall if NPS would create event logs for radius packets for unexpected clients.