I just found the doc I think you've read on the web. It's pretty good.
What he's talking about is that when you initially authenticate, PEAP-EAP-TLS establishes a TLS tunnel before sending any authentication credentials. Straight EAP-TLS does it's first phase in the clear, so certain information is visable. It's not really anything to do with whether a certificate is exportable or not on the client device (which is what I think you mean). I think I've got that right, but I'm going from memory.
Differences? Basically the most secure method is PEAP-EAP-TLS (PEAP-GTC is good too). EAP-TLS is almost as good, and PEAP-MSCHAPv2 is a weaker. PEAP is Mircosoft's implementation that encapsulates other EAP types. Other vendors do sometimes write PEAP functions into there software, so it's not only supported by Microsoft, but you need to check on a device by device basis as they don't always support all functions. e.g. Cisco adapters support PEAP-MSCHAPv2 and PEAP-GTC, and EAP-TLS directly in the ADU utility. But they only support raw EAP-TLS as far as I know (unless anybody knows different?). i.e. they don't support PEAP-EAP-TLS. You need to use XP Zero instead.
