Joining ISE to an AD Domain is not a bad thing at all. When you "join" ISE to a domain, an object is added (ISE) to an OU of your choice. ISE does not store the credentials used during the join. Since it's now a Domain Member, it can query AD Groups and perform user lookups etc.
An alternative to using AD integration is to use LDAP to the Domain Controllers or to an AD Replica. But beware. You cannot perform all authentication types with LDAP. You can only perform simple PAP auth. You cannot do EAP-PEAP for example.
Windows AD endpoint authentication without joining ISE to the AD seems kind of pointless/impossible. I say "impossible" with a caveat because there might be a hack around this. But nobody in their right mind would not use AD to perform machine/user authentication.
Device Admin (aka TACACS) is a different discussion. There is an argument to be had for creating accounts in ISE's database for network admins. No mandatory requirement to involve AD here. But you might eventually run into a brick wall in complex environments where it might be more convenient to leverage AD users and groups.
For Guest, you don't need AD. Unless of course you want to grant guest access to your AD users (obviously).
The ISE AD software stack is a very well written and well thought out part of ISE. Why don't you spin up a small lab and let your AD's investigate?
