Yes it is possible to do what you want.
set up ZS with two network cards, have them bridged and make sure the one AP you want CP for has its traffic coming in on the “inside” of the bridge.
then enable CP in bridge mode (on the inside network) and you should be in business.
