You can use the Posture status to return the appropriate role (or ACLs) if the status is UNKNOWN.
Please very carefully test what access you need in that posture unknown state as applications can be starting up already and may throw errors if they can't reach their servers before Onguard has made the posture check, posted results and access has been restored.
For that reason, some customers decide to consider clients healthy untill they get an infected (or other status) message. Limit on UNKNOWN is the most secure of course.