I didn´t realize that 9800 in fabric mode use a flex profile as well,  when I ran "show wirelless client mac x.x.x.x detail" is possible to see that, after I added the ACL on the default flex profile as you mentioned, the users connected to a fabric ...

I got the same issue, ssh on the port 830 geeting refused, I did a packet capture on the WLC and I got the same, TCP RST from the controller, all checks were fine, like netconf-yang enable and all other verification that I have found on other threads...

In 9800 you should create differents policy-tags (for finantial and Logistisc for exemple) with the appropriate WLAN Profile (SSID). On DNA (running 2.3.5) you have one policy-tag per floor, so It´s not possible to have those departments on the the s...