I have a policy set in ISE for my wired MAB devices. I then have various AuthZ rules matchine my profiles. If the device doesn't match any of these, we hit the default AuthZ profile which has a result on it to put these devices in an internet only ...