For Single SSID, you can send user directly to "Native Supplicant Provisioning" to immediately begin onboarding since the user should have already been authenticated via 802.1x. For dual-SSID, you need to send user to a web login since the SSID is open and as part of the Guest portal config have the allow employee to onboard setting configured so users are presented with an option to onboard after a successful web login. So you wouldn't really use the "Native Supplicant Provisioning" in dual-SSID.
The "administration" -> "Device Portal Management" -> BYOD portal is only for portal customization and doesn't really affect the onboarding process.

Hi MC, firstly thanks so much for your fantastic detailed videos. I've been able to sort out my Guest and BYOD very nicely.

The Native vs CWA redirect is something I came across because I am not using an open SSID for Guest or provisioning.

I have two SSIDs: Guest and BYOD but both are 802.1X. On ISE AuthC i only allow PEAP-MSCHAPv2 for Guest and it looks up either the Internal Guest DB or AD. If it's an AD user I redirect it to BYOD and when they're provisioned they go to the BYOD SSID which allows EAP-TLS only. Perhaps it's overboard - I could potentially do it on one SSID but later on I might want to have them on different VLANs

My big question - is it possible to have a Native redirect for Guest? In the portal list it only gives options for the BYOD portals, not Guest but in my case it would be very handy. Without that I am faced with either allowing the Guests directly on once they've auth'd with PEAP, or make them login a second time if I wanted them to get the Portal interface (AUP acceptance, password change etc)