Different IP range for Controller and managed devices

•  APIC-EM controller uses one IP for its management and also pushing/pulling data on managed devices. In a situation where managed devices are in different subnet, what's the best approach to make them talk to the controller

Usually to be taken care by the routing. You can add as many routes on the controller itself, however IMO, that may not be scalable. Instead, if you can point controller to a next hop or two, which in turn has routing for managed subnets, that'd scale better. If such next hop is a physical device like Cisco ASR, you can use appropriate routing protocol (BGP/EIGRP/OSPF etc.)