I'm bringing this up because when a Virtual Smart account has an existing Satellite, you are not able to create tokens from the Virtual Smart Account itself, you have to do it from the Satellite (see image attached). If you create a token from the satellite but still point ISE to CSSM in the cloud, it won't take the token. I imagine that the organization would need two virtual accounts and transfer the ISE licenses into the VA without a satellite to be able to license ISE accordingly.
In ISE, "Transport Gateway" is listed as a third transport option for Smart Licensing.
Interestingly, I was able to point ISE to an on-premise CSSM server using Transport Gateway and it worked ... for a day. And then ISE stopped talking to CSSM. The TAC eventually told us to use https Connection method instead. But it's interesting anyway to note that the ISE code is halfway there and intends to support CSSM.
Is the Transport Gateway still a supported Cisco solution? I have never used it but I see the appliance is available for download.