IoT transports run from the management plane of the controller, so use the (single) routing table in the controller. In most cases, yes that is a management network, and as it's outbound traffic, customers just (need to) allow that outbound from the controller's IP. Yes, you can create a dedicated VLAN, with IP, and a static route to your IoT server, and yes if that changes IP you would need to make sure that that traffic takes the same route (or is allowed from the default controller IP). The transport is an HTTPS tunnel (or at least that is the recommendation), so should not be able to break out anywhere.
------------------------------
Herman Robers
------------------------
If you have urgent issues, always contact your Aruba partner, distributor, or Aruba TAC Support. Check
https://www.arubanetworks.com/support-services/contact-support/ for how to contact Aruba TAC. Any opinions expressed here are solely my own and not necessarily that of Hewlett Packard Enterprise or Aruba Networks.
In case your problem is solved, please invest the time to post a follow-up with the information on how you solved it. Others can benefit from that.
------------------------------