Cisco ISE combines the features of NAC and CSA into one device.  It is a versatile device and can be deployed in the network to complement other network access devices.  For systems that use port security, this will allow a network to migrate away from that.  It also uses dynamic ACLs and moves away from traditional access by IP address.  The best way to deploy the ISE device is to allow it to learn or profile your network, called open mode.  This allows it to assess what traffic is normal on your network, inventories devices by MAC, manufacturer, segment, etc.  It also has the ability to check remote access clients when connecting into your network to make sure they have the latest AV definitions and patches.  This is usually accomplished through the Any Connect client that is pushed from the device or ran from a temp directory.  The policies can be complex and you should really allow the device to profile and then test before you try to go into production.