I got the same issue, ssh on the port 830 geeting refused, I did a packet capture on the WLC and I got the same, TCP RST from the controller, all checks were fine, like netconf-yang enable and all other verification that I have found on other threads...

In 9800 you should create differents policy-tags (for finantial and Logistisc for exemple) with the appropriate WLAN Profile (SSID). On DNA (running 2.3.5) you have one policy-tag per floor, so It´s not possible to have those departments on the the s...