If they are using FlexConnect most likely those ports will turn into trunk ports some day. i would just plan to use AutoSmart ports to remove the ISE configuration when the AP is plugged in. When the AP is unplugged it goes back to a standard access port.
The result in ISE for your Access points tells the switch to run the smart port macro.
!
! show macro auto interface
! Note: older IOS version use -eq instead of == in the if statements
!
no macro auto global control device
no macro auto global control detection
no macro auto global control trigger
macro auto global processing
!
shell trigger ISE-AP-CONFIG Cisco Access Points
macro auto execute ISE-AP-CONFIG {
if [[ $LINKUP == YES ]]; then
conf t
default interface $INTERFACE
interface $INTERFACE
description Access Point
macro description $TRIGGER
switchport mode trunk
switchport trunk native vlan 123
switchport trunk allowed vlan 123
spanning-tree portfast trunk
exit
fi
if [[ $LINKUP == NO ]]; then
conf t
default interface $INTERFACE
interface $INTERFACE
ip access-group ACL-DEFAULT in
authentication event fail action next-method
authentication event server dead action authorize voice
authentication event server dead action authorize vlan 123
authentication event server alive action reinitialize
authentication host-mode multi-auth
authentication order dot1x mab
authentication priority dot1x mab
authentication port-control auto
authentication periodic
authentication timer reauthenticate server
authentication violation restrict
dot1x timeout tx-period 10
dot1x timeout held-period 300
dot1x timeout quiet-period 300
dot1x timeout ratelimit-period 300
mab
dot1x pae authenticator
exit
fi
}
