If you are using Cisco IP Phones and have CDP enabled, you can use CDP Bypass to allow the phones on in the Voice VLAN automatically and then only authenticate/authorize the Data device. You would need to configure the switchport host-mode to be "single-host". That will limit you to just one MAC address on the Data VLAN. The downside of this type of setup is the lack of visibility of what phones are on the network and on which switches/ports. Someone could spoof the phone MAC address and CDP messages to gain access to the Voice VLAN. You could just authenticate the phones using MAB. Just build a whitelist of your phone MAC addresses in ISE and it would only use up a Base license. But that gives you the flexibility to use dACL's, centrally configured timeouts, etc.
