Hi,
If you enable both MAC auth and dot1x on the same SSID, it works as follows,
1. always MAC auth first then dot1x
2. If MAC auth success and dot1x failed, user will get MAC default role
3. If MAC auth success and dot1x success, user will get dot1x default role ( or SDR/VSA role)
If you are looking for something similar, you can enable both on the same SSID.
Please feel free for any further help on this.