On the controllers (AOS8.4.0.4) the auth servers are all using the non-standard port numbers.
On CPPM it is set to match ALL on the essid and the Connection Dest-Port (I did as you suggested and checked that this looked like the right attribute).
The service is actually a RADIUS proxy, so we are just punting these requests off to our existing FreeRADIUS servers (we'll start moving auth down to ClearPass soon but for now everything is just proxied through).