2 - You can enable or situation FlexConnect with previous validation?
Not going to be easy if you don't have a dedicated authentication server at the site.
With traditional connection (non-FlexConnect), when your LAN or WAN link (to the WLC) goes out, the APs can't do anything. Clients will loose connection. With FlexConnect, when the WAN link to the WLC goes out, current clients will still be connected to wireless, HOWEVER, you need a dedicated authentication server so the wireless can accept NEW wireless clients.