There is nothing really specific required to handle clients behind NAT, but the profiling information ISE has for these clients may be off or partial. As long as the radius authentication being sent from the network device itself isn't natted, then you will handle it like regular endpoint authentication.
If the switch communicating with ISE is behind nat, then it's a whole different can of worms.
