I finally opened a support case and the problem was more complex than I thought...
First of all the reason why I couldn't authenticate with the MAC address was because the endpoints (i.e. the Laptops or Smartphones from our Guest Users) did not have any "Guest Role ID" associated with them.
The "Guest Role ID" is supposed to be set to "1" for the Contractor role, "2" for the Guest Role and "3" for the Employee role.
This "Guest Role ID" is referenced as one condition in the Enforcement Profile of the MAC authentication service for the Guest SSID.
The reason why "Guest Role ID" was not set correctly was because I referenced the WLAN controller with two different IP addresses in ClearPass. In one instance I referenced the WLC with its physical address, in the other with its VRRP address.
That is why in the RADIUS logs I always got this message:
ERROR Common.NadClientTable - getNadClient: Unknown NadClient 172.22.2.10
So I now have three network devices in ClearPass. The master controller with its physical IP address, the standby controller with its physical IP address and one for the VRRP address.
This way we got rid of the "Unknown NadClient" messages and the "Guest Role ID" is now set correctly.
As a result, my Guest WLAN now works the way I want! :-)