Probably you already resolved this issue by now? one of the main differences between low-impact and closed mode is that with the low-impact mode you would have a default access list applied to the port where some traffic will be allowed. In closed mode anything will be denied on the switch port with the exception for EAPoL traffic until the authentication and authorization are completed. Another main difference in low-impact mode is that the traffic on the switch port will still be passing even if ISE returns an access reject and it will be subject to the switch port access list.
Now for the IoT or whichever dummy devices to start the authentication process they need to send at least one frame to the switch before the switch relay that info to ISE and based on the response back from ISE the authentication will be accepted or rejected. The devices do not need any IP addressing during this process, and the main detail that will be taken from the frame received from the devices to the switch port is their MAC addresses. Those MAC addresses will be used as their credentials for authentication and also authorization.
Assuming the authentication has passed, the authorization process would start, and the returned attributes from ISE will be applied to the port, whether to fully open the port or apply specific attributes.
This process should not change if the port is in low-impact or closed mode. As long as the IoT device sends a frame the switch will take it and relay it to ISE for authentication and subsequently for authorization. If the IoT device does not send any frame this whole process will not be triggered.
Rebouncing the port usually helps as the connected devices to the switch ports might send some frames, however, other devices might not. Also, some devices might send frames periodically which means that you would need to wait for some time before those devices start talking to the switch by sending some frames.
Were you getting anything on ISE logs for those devices?
