If an AP is claimed by R1, if it loses access to a local controller, it will reach out to R1 and assume whatever configuration is present there as well as upgrade its firmware.

To prevent this from happening, you can create a packet filter rule to block the AP's from reaching out. Additionally you can create a DNS override for the FQDN that the AP's are resolving.

First create a WAN Target with 'device.ruckus.cloud'
Next create a Packet Filter on the policy that contains the AP's. Select the WAN Target created above, choose both directions.

Optionally, go to Services->DNS and create a new DNS Record. the FQDN is device.ruckus.cloud, the IP can be your local controller.