GCisco wrote 

1. Are the EAPs getting valid IP addresses from DHCP Server and showing as Connected on the Controller? YES
2. If you configure the valid static IP on your wireless clients after connecting to EAP's SSID, would it be able to ping the Controller and access internet? No, its also shown no internet access
3. Have you configured any advanced or other settings via Controller, like VLAN, Multi SSIDs, Band Steering or Airtime Fairness? We just have vlan 2 which is never changed

It's a bit too vague to state just »clients get no Internet« for a description of a malfunction between clients and the router. Can you narrow down the problem a bit further?

• Can clients with a static IP ping the EAP?
• Can they ping the switch?
• Can they ping the controller?
• Can they ping the router?

If so, basic connectivity is given.

You say you use VLAN 2 and clients don't get an IP dynamically using DHCP. Please describe how you use the VLAN.

• Is the switch's DHCP server assigned to VLAN 2?
• Is the SSID – or if Multi-SSID: are the SSIDs – assigned to the VLAN 2?
• Is the VLAN 2 just the management VLAN for the EAPs?
• Is the switch port of the switch to which the EAP is connected a tagged or an untagged member of VLAN 2?

GCisco wrote

Issue fixed after changing the switch ports to tagging instead of untagging, however i kept the upstream Firewall as untagged, thanks for your reply.

Ok, then it probably was this bug fixed in EAP225 firmware 2.4.0 released 2018-11-21 which made the difference between old v2.3.0 behavior versus v2.6.1 behavior:

• Fixed the bug that wireless clients connected with 2.4G SSID of EAP may receive broadcast packets from other VLAN.