Everything work here, including the opposite! Really
You can have:
internet <-> Zentyal <-> AP <-> clients
or
Internet <-> AP <-> Zentyal <-> wired clients
or even anything else you may imagine.
What is really important is to understand what are services you need to provide, what are components providing it and how all of this may conflict, overlap or create holes. You have also to pay attention to features offered by each component: in case some filtering or routing is not possible, this could impact your choices.
Once this is (technically) understood, you have to decide on best strategy which will depend on what really matters for you. If having one single HTTP proxy with filtering is a must, internet <-> Zentyal might be the right choice.
From my personal standpoint, this design is the more efficient and I'm even not using WAN features of various AP deployed in my own network: almost all wired or wireless clients connect to same network and same segment.