BYOD with internal CA is to enable you to register non-corporate devices and allow you to issue certificates to devices for use as a persistent identity attribute.
Third party MDM allows you to query an external product for characteristics of the supplicant device and use the returned value in making AuthC and AuthZ decisions.
As described in the ISE Admin Guide:
Mobile Device Management (MDM) servers secure, monitor, manage, and support mobile devices deployed across mobile operators, service providers, and enterprises. MDM enforces policy on endpoints. As it is network blind it cannot force users to register their device and comply with policy. ISE can be made aware of policy that requires devices comply with MDM policy, so that ISE can make the users to register the devices. If the ISE device policy requires MDM and the device is not compliant with MDM, then ISE redirects the user to the MDM onboarding portal, prompting the user to update the device to get network access. ISE can also allow Internet-only access to users who decline MDM compliance.
