With the 8.8.1 release, RADIUS MAC Authentication can be configured to assign roles to clients both before and after

Radius 8.8.1 Secondary MAC Authentication Role Based Control