ISE has no visbility into the wireless guest network as its not managing it. That limits the options available. Might be best to reach out to wireless/prime team to validate some of these options.
Also see a similar thread Block Employee MAC's on guest SSID?
if you have a simple guest splash page from the controller then maybe the controller can query prime for mac addresses seen on internal network?
if they are requiring them to do LWA to the WLC guest portal then don't allow employees to create accounts
•Anyconnect Network Access Module (windows only), restrict their window machines from connecting to unsanctioned WLANs?
•Enterprise Connection Enforcement How-to guide Admin Guide
If integrating with ISE
•Only allow sponsors to create accounts for visitors
•restrict access to 1 device per credential
•Register Corp machines into special endpoint group
•If MAB and Corp ID Group then deny access or redirect to restricted message portal
•Profiling to differentiate access (requires plus license)
Use profiling to differentiate corp devices. You can use Windows GPO to write identifiable string in to the browser user agent or DHCP client ID field that ISE can use to differentiate the corp devices. (Need Plus License) once you have the endpoint group created and populated, you simply need to redirect to a different portal to notify the user is not allowed on the guest network.
•WPA2 Guest network (no open network, no portal)
•Corporate Devices using cert auth
•Guests use sponsored credentials with allow guest type to bypass portal
