Hi Remco,
Please visit the below listed link:
http://www.cisco.com/en/US/docs/net_mgmt/cisco_secure_access_control_server_
for_windows/4.1/configuration/guide/noagent.html#wp1083264
You'll find a section called "Default Action", the MAC address that are not
found on local database/LDAP, are assigned to the group selected in this
section.
If we do not want all the MAC address to go through MAB, then select a group
for Default Action, and disable it.
HTH
Regards,
JK
~Jatin