Configuring Authentication with Active Directory and TLS

Dear, finally I could put in work my Freeradius server following the "Configuring Authentication with Active Directory" tutorial from Alan Dekok, using NTLM_AUTH for MS-CHAP. But now I have the following question: in order to create a secure TLS channel to authenticate WiFi users with a valid TLS certificate, is the use of EAP mechanism and inner-tunnel file the right way for this ??? Special thanks, Tom Yard