A protected VLAN is the VLAN that EAPS stops from making a loop. It is the VLAN you want to have redundant. The control VLAN is the VLAN that runs the EAPS protocol.
Running STP on an EAPS is a tricky design as you need to make sure that neither blocking protocol blocks the other. If this is on one EAPS domain ther is no reason to have both. If the design uses EAPS in a core ring and STP out to the edge then we would need to look at the design.
Why do you need STP and EAPS together? Was the loop only on one VLAN ?