RADIUS - WPA authentication with root certificates, but not domain user credentials

I have an 802.11 (WPA/TKIP) infrastructure utilizing RADIUS (Cisco+Microsoft IAS). It is based on security group membership.  I have no problem with XP and Vista machines that are domain members (set for auto-enroll) authenticating. I have also successfully authenticated with wi-fi BlackBerries. I am no facing a project where I need to add handheld warehouse scanners (WinMo based) to the network as part of an bye-bye-WEP migration. I understand the concept of having the root certificate on the device and I also know that validating a domain username/password is part of the current authentication process.  I want to sort of "pre-authorize" certain devices while still maintaing a higher level of security and accounting than WEP can provide.  I just don't see it feasible for the typical warehouse worker to have to enter domain credentials every time the device connects to an access point.

Is there a way to bypass the domain user credential checking but still require the root certificate or the root certificate plus a MAC whitelist somewhere in an IAS policy?