It is easy enough to turn the LED off on the access point. This might make it a little more difficult on occasion to troubleshoot the AP, but we have monitoring kit and the ability to log in so we should be fine.
To do so, logging in through Cisco Prime it is the bottom tick box option on the configuration page:
Rather than painting the access points we found that we can get AP skins that are designed to allow the wireless signal through and fit our internal antenna AP's (1142, 3502, 3702).
They are on Cisco's marketplace here. We also found international shipping from the US here and here.
They have a clip and included is some velcro stickies to make sure the cover doesn't come off if it is ceiling mounted (but easy enough to get off should you need to).
Note: Skins are paintable using an enamel spray paint such as Krylon (do not use oil based paint or metallic
paint). Surface does not need to be treated.