Before device onboarding can happen, the user need to be known by the system. When ever you use MAB as a way to get user redirected to a portal, the portal need to be CWA so user can enter credential as MAB by itself contains no user info. This is true for both wired and wireless with Dual-SSID
On the other hand, if user authenticates using 802.1x where user credential is already provided, we can pass user directly to NSP portal. Again this is true for both wired and wireless with Single-SSID.