I have not done it myself and can't find a document specifically for BYOD in Foreign-Anchor setup.
keep in mind that different people perceive BYOD in different ways, I have seen countless people call guest devices as BYOD (which is not incorrect)
In Cisco's terms, BYOD is when internal users bring their own devices and as organizations want to give flexibility to work and access internal resources on some well provisioned personal devices, that's why it involves certificate provisioning for these devices via ISE and integration with some form of MDM to ensure device check.
Guest is a different case and it makes sense to tunnel all traffic to Anchor in DMZ, because you don't want guest devices to access anything internal, not even DHCP or DNS, once tunnel to DMZ, traffic can not come back in to inside (low to high) unless allowed explicitly and can only go out to internet (high to low).
So its important to know if you are planning to deploy BYOD or Guest with Anchor setup in DMZ.
if you are trying to do guest here is a link.
https://www.cisco.com/c/en/us/support/docs/security/identity-services-engine/115732-central-web-auth-00.html
if you still plan to do BYOD with anchor setup, you can try the flow logic is still same. I haven't tried it myself yet.
hope this helps.
-hope this helps-
