Hi there. I know it can seem confusing at first. This is covered in some detail in several documents, listed below.
The short answer is your choice "3) Other".
The smallest 4402 controller in an anchor controller (dmz) roll can support 40 foreign (internal) controller. Each foreign will build exactly 1 tunnel to a given anchor. If there is more than 1 SSID to be foreign exported (anchored) then it will ride the same tunnel.
Hope this helps.
From SRND:
"The most cost-effective platform to support guest networking in most enterprise deployments is the Cisco 4400 Series controller. Assuming the controller is being deployed to support guest access with EoIP tunnel termination only, the 4402 with support for 12 APs is sufficient because it is assumed the controller is not going to be used to manage LAPs in the network.
A single 4400 Series controller can support EoIP tunnels from up to 40 foreign controllers within the enterprise. Additionally, the 4400 supports up to 2500 simultaneous users and has a forwarding capacity of 2 Gbps."
Start with:
http://www.cisco.com/go/srnd
Have a look at the wireless mobility 4.1 SRND -it is your friend. Look in the section titled "Wireless guest access overview" and "WLAN controller guest access"
Also search cco for "auto anchor mobility" and "configuring guest internet access".