Question / Best EAP concept to use for machine & user auth combined

Hey guys Are there any recommendations from this group on what type of EAP we should use / implement with FreeRADIUS 3.2 to achieve this: 1. authenticate the machine first with a flavor of EAP 2. authenticate the user with a flavor of EAP, BUT onlxy if the corresponding machine was successfullly authenticated first? Let's say we want to get sure, that only corporate devices with corporate users get on an SSID. I know there is the concept of TEAP and EAP chaining (I think of it as a Cisco proprietary protocol), but is there a best practice way to do this on FreeRADIUS for different kind of end devices (eg. Mixcrosoft, macOS, and so on)? Thanks in advance Dominic Gesendet von Outlook für iOS<https://aka.ms/o0ukef>