Typically wired 802.1x is used in an enterprise setting, where devices are under control of the IT staff. In that case provisioning devices with a certificate can be done easily and it all works pretty smoothly. Likewise enterprise settings want to put all users on the same (or a small number of) VLAN(s). Any devices outside of IT’s control, such as employee phones and tablets, will be restricted to a guest network with no access to anything beyond the internet connection.

In this case neither is true - they have no control over devices being connected so can’t rely on SSL certs, and they explicitly want to isolate each user on their own VLAN. Given those constraints this is a much harder problem to solve.