Hmm, I sent this response earlier, but I guess email response might not be working...
ClearPass can join multiple domains and even auth against those domains in the same service! In fact you can auth against any (and multiple) compatible auth sources in the same service (AD, LDAP, Guest User DB, Local User DB, Postgres, MySQL, MS SQL, and Oracle 11g).
What this means is that the same SSID could have user accounts it any of those places. Then, if necessary, you can differentiate access based on the auth source and/or other attributes we get from those auth sources.