EAP-TLS is the method that should be selected to meet the requirements for designing a new secure wireless network. EAP-TLS (Extensible Authentication Protocol - Transport Layer Security) is an authentication protocol that uses X.509 digital certificates for both clients and servers. It provides strong security and mutual authentication by using TLS encryption and public key cryptography. It does not use plaintext passwords or shared secrets that can be compromised or guessed. It is also an open standard that is vendor neutral and supported by most wireless devices1. Reference: https://www.securew2.com/blog/what-is-eap-tls 1

Split tunnel is a configuration that allows a remote user to access both the local network and the Internet at the same time. In a split tunnel configuration, only traffic destined for the corporate network is sent through the VPN tunnel, while all other traffic is sent directly to the Internet. This allows the remote user to access the Internet without the company's VPN server being able to monitor or intercept their traffic. Using a split tunnel configuration can help the company to mitigate employee concerns about internet activity being monitored and reassure employees that their private internet activity is not being monitored.

Link Aggregation Control Protocol (LACP) is implemented specifically to enable port aggregation (AKA NIC teaming).

A PoE injector is a device that provides power over Ethernet (PoE) to a WAP or other network device that does not have a built-in power supply. A PoE injector connects to a power outlet and an Ethernet cable, and sends both power and data to the WAP. If the WAP was moved to a location where there is no power outlet or PoE switch, it would need a PoE injector to boot up. References:
* Part 3 of the current page talks about PoE and PoE injectors as a way to power WAPs.
* [This article] explains how PoE injectors work and how to use them.

It is a fiber network and fiber has insane range thus it is unlikely to be attenuation. Bad device and bad cable are out because they are explicitly tested as described. Therefore TX/RX is the only reasonable option.