Cisco – WLC – How to disable 2.4Ghz

I see no reason not to enable it if your WLC/AP's support it.

At the end of the day the neighbour list is only populated with neighbours that are under the same administrative control as the original AP and so it doesn't really open you up any more than a usual WiFi connection would.

If you don't need to confuse your users with multiple VLANs, don't do it. Leverage the tools you have. You mentioned you have ISE and you should be able to do all this with one SSID. As AdnanG already mentioned, you can utilize the profiling features of ISE to classify the devices.

Your ACS should be able to tie into the MS AD authentication and be able to provide user authentication and group information.

From there, you just need to combine the user/groups with the device profiles and then tie it to a VLAN. So, for instance, if the device is identified as a cell phone and the user is part of "group A", then the get put in the "group A - internet" VLAN.

I haven't done it personally with ISE, so can't give exact steps, but this is how Cisco marketing is selling ISE in the BYOD space. I also know of several people who have done similar setups to what is suggested. I would start by looking through this Cisco BYOD document that would give you a general overview of how BYOD is done with with Cisco ISE.