I've never attempted this but off the top of my head it is possible. However, you'd probably need to work to the lowest common denominator with security. So if you are allowing guests to this same SSID, then you'd likely want them to have their own username and password, which means a web-form based authentication - which in turn means an Open security network.
Based on the above, you'd also be authenticating AD users on an open security network - leaving it open for someone to intercept wireless traffic and get AD credentials from staff.
So I wouldn't do it personally. ISE certainly supports using multiple user database sources (like AD, local database etc), but whether it's good to do it in this case, i'd err on the side of no.
Any particular reason you want to do it this way? My preference would be:
CORPORATE SSID: Use WLC and direct RADIUS to AD Network Policy Server using 802.1X (EAP-TLS or PEAR-MSCHAPv2 etc). Unless you need NAC and posture from ISE etc of course, then use ISE as the authenticating and authorizing server.
BYOD SSID: If you have an MDM in place (MobileIron, AirWatch etc), have devices enrol and then deliver a certificate to allow EAP-type authentication. Aagin this could be directly against Microsoft NPS or to the ISE.
GUEST SSID: Use the ISE with an SSID in Mac Filtering mode with RADIUS MAC (called ISE NAC in WLC v8.3+) to authenticate users. You could use this method for BYOD SSID as well if you wanted to.
Hope that helps. In short yes you can do what you want, with the RADIUS server for that SSID being the ISE, setup to use multiple user sources. But I wouldn't do it.
