There isn't a published max latency between ISE and the external directory/AD per say, but it's a function of the lower the better. Ideally you would have an AD server in the same location as the ISE node with AD sites and services defined.
The key is that the entire NAD to ISE to AD to NAD again needs to stay under the configured radius timeout value on the NAD. The general recommendation that tends to work well in most environments is keeping the whole round trip under 5 seconds. In some larger environments this has been configured at 10 seconds.
Keeping an eye on AD latency can be done via the ISE dashboard alarms/syslog/email alerting. You typically don't have to worry about it by default unless you are seeing the alarms, or you NADs have something like a 1 second timeout configured. I bring up the 1 second radius timeout because I have run across a lot of WLCs configured for this and it causes problems all the time.
