Hello Reyad,
With NAC, you need that all your user traffic is going through the clean access server for at least authentication. Since you don't probably want that traffic from remote site still need to go through the NAC Server after authentication, you may want to go for a Out Of Band (OOB) deployment, with layer 3 support, since your remote sites mighte not be all L2 adjacent to the central site (depending on your connections between your sites).
Basically, users will be put in a VLAN, let's say A, before authentication. You should find a way to direct all traffic from VLAN A through the NAC Server. it's fairly easy if you have L2 connectivity, otherwise you need to implement policy based routing (PBR).
After authentication, user will be put in VLAN B, and traffic from VLAN B shouldn't go through the clean access server.
Hope this is clear.
