You can do a whole bunch of things with ISE. Mainly ISE can be used to manage the users and devices accesses to the network. It also can serve the guest and BYOD flows by providing portals to authenticate the users or event to register the new users. Another thing can be done with ISE is to discover and map the IP to the users passively. ISE can also do profiling to the endpoints connected to your network, this feature is hugely used and it is really useful to help you categorize the machines connected on your network, and potentially allowing full, limited, or deny accesses based on the profiled data, there is much more to it. To focus on your question, if you can integrate the end users laptops to your AD then you can join ISE to your AD and set up the authentication and authorization policies to allow or deny based on the users identities. For example, if user1 is part of the AD group1 then allow full access, and if user2 is part of the AD group2 then allow limited access, and so on. If the end users laptops will still be not domain joined, then you can do MAB which is not a best practice as it could be easily spoofed, or you can still leverage ISE by using profiling for example, admin accesses to your network devices, guest flow, and also here there is much more that you can do with all these things. Obv if you decide to integrate ISE to your environment then you would need to configure ISE itself and then the switches with the right aaa commands set, that would be for wired. If you use wireless too then you need to configure the wireless controller as well.
