@Al-from-Ottawa 

1. Firmware upgrade?

Want to upgrade to the latest firmware compatible with our controller and EAPs. All came with 1.x versions. There are all sorts of warnings about ensuring that controller and EAPs are upgraded to compatible versions. Current versions for the EAPs seem to be 1_5.x.

So can I upgrade, and when I do does it matter in which order I upgrade EAPs and hardware controller?

I suggest you to upgrade your OC200 first, then upgrade your EAPs.

2. Guest Zone

We need a proper secure guest zone with a password, not the open guest zone that is created by default. Do I need the firmware upgrade to be able to do this? Have not yet found a way to reconfigure the guest zone. 

Not sure what do you mean guest zone, guest SSID? You can just create a new SSID, set a Wi-Fi password, and enable Guest Network on it. Devices on the Guest network cannot reach any private IP address.

3. LAN-only zone?

I would like to create an additional SSID for LAN-only access (for some gear that I don't want exposed to the internet), and perhaps once I have it working turn off SSID broadcast to further hide it from the public. Is this feasible?

Turn off the SSID broadcast will stop new devices from connecting to this SSID, but not like prevent it from exposing to internet.

If you mean: devices connect to that SSID cannot get internet access, but can get LAN access only.

You need to set EAP ACL rules. One for allowing devices access LAN, one for blocking devices access IP address any.