When you have a combined PAN, PSN and MNT node, it does not support a separate PSN. Look at the reference here:
http://www.cisco.com/c/en/us/td/docs/security/ise/2-1/install_guide/b_ise_InstallationGuide21/b_ise_InstallationGuide21_chapter_00.pdf
The deployment you mentioned is somewhere between Small and Medium deployment. I would recommend adding another PSN (you can have upto 5), so that you have separate PSN and remaining functionality. If price is a criterion, you can have 2 nodes doing all personas - which gives you the same supported user count as Medium deployment.
