I had the same issue with a similar set up. The outside user (and me as a test outside) had a older version of Anyconnect Secure Mobility than ISE has installed to push to internal users for VPN. When trying to get the Anyconnect Compliance Module ...