Could CAPWAP over the Internet be made safe enough to use without VPN

I'm thinking about ways to support a remote group of users at a WeWork type site. If I could just ship them a pre-provisioned WAP that would automatically tunnel their traffic back to our controller, it would ideal.