Your vendor is correct - EAP-PEAP uses username and password, and does not use a client certificate (that would be EAP-TLS). What your vendor is not telling you, is that with any good EAP implementation, the clients SHOULD validate the RADIUS server (i.e. ISE) certificate when the TLS tunnel is established. That check seems to be happening and it failing, because the ISE cert has been changed - therefore the client no longer trusts ISE. Which is good.
I don't know what your ISE EAP Server Cert looks like and how it was generated - I hope it was generated by a PKI (Root CA etc.) - in that case, the client devices should NOT have the ISE EAP cert installed, but rather, they should have the Root CA and all other CA's that were in volved in creating the ISE EAP cert. In that way, no matter how often you change the ISE EAP cert, the client will trust ISE as long as the same Root CA and and any Issuing CA's are still the same as before.
If (heaven forbid) the ISE EAP certificate(s) are self-signed, then you need to get that cert into all those "IOT" style devices. That would be a reason to implement a PKI and get ISE EAP certs signed properly. Any device that does EAP should have some kind of interface (graphical or CLI) to manage the supplicant (i.e. the 802.1X software stack)
