That is correct. The protected is typically plugged into your existing wired network and clients reside on the managed side of the BSC. Traffic flows in the managed and out the protected. By default the BSC will NAT the managed network IP addresses to the protected IP address. Traffic must flow through the BSC in order for it to enforce firewall policies, provide bandwidth management, etc. Guest traffic could flow in the managed, out the protected, over your existing wired network, and out to the internet and you could leverage the BSC's stateful firewall to prevent guests from accessing everything but the internet. In that case your existing wired network should reside on the protected. Instead of guest traffic flowing over your existing wired network, you could also have a dedicated internet connection just for guest access where guest traffic would flow in the managed, out the protected, and out to the internet. Again the internet should reside on the protected. So you said you had:
1. Connection to Internet in Managed Port 1
2. Connection to AP1 in Managed Port2
3. Connection to AP2 in Managed Port3
4. Connection to LAN in Protected Port
1 is incorrect as the internet should reside on the protected side of the BSC. 2 and 3 are correct. 4 could be correct if you wanted traffic to flow in the managed, out the protected, over your existing LAN, and out to the internet. If you didn't want traffic to flow over your existing LAN but instead in the managed, out the protected, then out a dedicated internet connection, then the internet should be on the protected instead.
