In the second link that Jason posted focus on a few things. The number of active/concurrent endpoints (probably low for Device Admin), the number of authentications and lookup types per second, and finally the number of tacacs authentications and authorizations per second are what you need to focus on.
Without knowing these items, I would probably scope 3595 PAN/MNT nodes, they are usually the crux in any larger deployment. Because you are planning only two PSN's per DC, you will have to look more closely if a 3515 scales to what you need, 3595's if you want to just play it safe again.
You should be able to run the reports from ACS to gather statistics if the monitoring node isn't dead. Design for the peaks, ex. if most of the load is done during work hours, or if it is consistent throughout the day via automated tools. If one PSN is down, will the remaining one have the capacity to continue running, or maybe you mark the VIP down in this case. Lastly, DC differences, if you have a DC or two with less load, maybe they only need 3515's but the two DC's with more load have 3595's.
Link I was referring to.
https://community.cisco.com/t5/security-documents/ise-performance-amp-scale/ta-p/3642148
