Having two ISE interfaces on the same subnet (whether, two single interfaces, or two pairs of bonded interfaces) achieves nothing. Gig0 (or Gig0+1 = Bond0) is the only interface at L3 that responds to SSH - that means if you wanted some Management / Services separation, you should design your L3 such that Gig0 (or Bond0) only receives and initiates management (SSH, SNMP, HTTPs etc.) and Gig2 (or Gig2+3 = Bond1) handles RADIUS/TACACS/Portal (and that is the IP your NADs will use) - the separation is a Layer 3 separation.
Bonding is useful if you want your physical nodes to have some survivability in case of cable or upstream switch failures. No need for bonding in VMs and bonding is also not a load balancing mechanism. In other vendors it's called NIC Teaming - it's very simple stuff for L1 redundancy.
If you separate your control and services interfaces, it only makes sense on PSNs (no need for this on PAN or MNT nodes). And it also makes routing more complex on the nodes (you need an extra static route for the additional L3 interface. But most annoyingly, Cisco won't display that interface or IP address in the GUI - you only see it on the CLI - to the unsuspecting engineer, they won't even know it's there unless they look on the CLI. Aruba did this properly in Clearpass where they clearly distinguish between Management and Data interfaces - Cisco's half-hearted attempted was an afterthought at best.
