Yes, that´s correct. WLC supports Local EAP.
you can follow @Mohammed al Baqari statement with recommended options basics.
Further, you can create a separate SSID for guests without giving internal network access.
you can also integrate with Radius using the certificate for more security, you can also use a mac base authentication as well.