Based on your question I assume you have the 8021x solution requirements established/deployed (PKI, GPO to configure windows native supplicant OR anyconnect client to support it, ISE policy sets to include authorization profiles, etc.).
Utilizing 8021x in your SDA fabric should be straightforward. Within DNAC under your fabric, host on-boarding, you can select your authentication template to be used, which in your case would be closed OR open authentication template. From there you can manually provision your host ports with device type user, and either static policy (SGT, ip pool) OR just provision the authentication method and not use static policy. Not using static policy forces ISE to come into play to authenticate, authorize, and deploy network policy to your nodes. DNAC should automatically provision your edge node ports accordingly and your hosts should authenticate via 8021x or mab (as long as the requirements above are in place).
You have a couple of options. You can utilize Trustsec SGTs to control connectivity to your 10 dot IPs (either SDA SGT to SGT, or static ip-to-sgt mappings via SXP if the 10 dots sit outside of your fabric), or you could use the template editor to configure things such as new ACLs, modification to ACLs, STIGs to harden devices, etc. and deploy/provision a fabric device in your underlay with the created template. Hope this helps!
