Service port doesn't have a default gateway in its configuration therefore it can be only reached if you are on the same subnet or configure a static route in the WLC - Controller > Network Routes > IPv4 Routes > New. And you'll need to add route back from HQ to WLC service port subnet if not yet existing.
Not to be able to access the Service Port DIRECT. If Plant 1 host the default-gateway for the Service Port subnet, then the only way to get into the Service Port is to remote into Plant 1 and initiate a telnet or SSH from Plant 1 to Service Port. This is because to configure the Service Port, you only need to provide it with an IP address and subnet mask. Service Port does not have a default-gateway address. What model is this WLC?