i believe the answer to your first question is as i remember, both authentications are enabled then it will exam mac authentication first if fails, then eap will come in to play. i may have to double check with the most current ios though.
for the second question in regards to group settings, yes you can. it's called Network Access Restriction (NAR). you can creat different user groups and assign different group settings. however the right way to do your requirements is to set two different SSID with each authentication method.
let me know if you need further clarification.
a rating would be appreciated if it helps.