For EAP discovery you need to open TCP ports 29811, 29812, 29813 and UDP port 29810 in the firewall on the Controller side. If you want to use portal functions or if you need remote web UI access to the EAP Controller, TCP ports 8088 and 8043 must be opened, too.

You wrote you have assigned a public IP address to the server running the Controller, but in Discovery you did use a private IP address (192.168.1.81). If not using some kind of VPN between the branches and the main office, the private IP does not get routed on the Internet.

Here is how I manage to have different branch sites connect to the central office: EAP Controller runs on a system with a public IP address, ports mentioned above are open in the firewall. DHCP server in private LANs at branch offices communicate the Controller's public IP through DHCP option 138 (CAPWAP), so the EAPs will enter discovery stage as soon as they get a DHCP lease. The EAPs must not run in stand-alone mode for this scheme to work.