I did exactly this and it did not work. My controller had 0 users when I connected and all 3 devices were able to connect to eap-peap SSID and get an IP address. For testing -see below- I want to deny access if you are on more than one device with AD credentials.