@Mendylivium
There is no VPN client on the AP.
The only angle I can think of to get around CGNAT (admittedly only 1 coffee into the day..so be gentle) is to leverage a remote controller. You can configure the AP to be managed by a controller located elsewhere (including the TPlink cloud controller offering) even behind a CGNAT. However, that's where the out-of-the-box bit ends...you'd need to find a way use the API to force a client to reconnect (I know freeRADIUS allows for some scripting to get integrated within the whole process, so you could insert something in the pre-auth portion for a device that is to be removed), which would then fail when it tries to AUTH again via your updated RADIUS server.