If you are doing vpn to an ASA or ISR and using ISE for basic radius authentication and authorization, there is no additional licenses required for ISE. If you are doing posture with AnyConnect against ISE, then that will require apex licensing on both AnyConnect and ISE.
