Try to think of it in this way. Amps is 'drawn' up by the charge controller by variating the resistance on the PV circuit. If it sets high resistance on the PV circuit, the PV voltage will stay up high. When it is sweeping the MPPT to find maximum power point, it will gradually lower the resistance on the circuit, which 'pulls' down the voltage and increases the amps, until it pulls the maximum current that it can until it hits its max amp rating (which may be well under Isc max possibility of the PV circuit).
A good quality charge controller wouldn't be able to draw more amps than it can handle. Victron for example, you can see they have a footnote in their spec sheet for the 250|100 (a model I own), which says:
"1a) If more PV power is connected, the controller will limit input power." (see picture)
Generally speaking, over-paneling should be fine to do, as the charge controller will not pull down the voltage enough to draw more than it's highest amp rating. Obviously, this may not be a blanket statement for all brands. Victron allows it. The biggest number you can't go over though is on Voc.
But I might send a letter to the brand manufacturer and ask them if you can over panel on Isc with their CC safely. Victrons can over-panel, they just won't allow to pull more amps than their max, so it will just be wasted watts (good for dark cloudy days though).
There are multiple other threads here talking about over-paneling (
https://diysolarforum.com/search/614232/?q=overpaneling&o=relevance ). I would think any decent CC would not have a problem, and would simply not be able to load the circuit (pulling down the voltage enough), to go beyond its max rated amps.
Some people have even used charge controller (like the Midnite Classic 250), with a battery connected to supply the PV side), like on the Prius hybrids for example, and the Midnite Classic will only pull up to max amps rating off the battery (connected on the PV side). They had used a charge controller as a workaround to use a 210 VDC Prius hybrid battery to charge a home 48v battery bank, with good success. The charge controller would only load down the circuit sufficient enough to reach its max amps rating.