PoE Access Point - Connection

With a suspended ceiling or sufficiently dimensioned empty conduit, the Keystone is sufficient.

Well, drywall attached to a metal substructure. That means there is not much space left for the foil below the insulation from the attic ceiling to the roof space where the box would touch.

That is enough. The Keystone adds 2.5 cm. Then patch cables and access point are mounted over the hole.

So the LAN cable would lie with the keystone in the ceiling (Zwischenraum) and only the patch cable would basically come out of the hole?

Exactly. LAN cable just long enough that you can pull it out. Connect patch cable and push it back in...

I would also recommend the flush-mounted box.

What I have also seen as an emergency solution was a spacer ring between the access point and the ceiling. In the cavity, the keystone module and the short patch cable were then hidden.