You may have a look at this video for an example.
From the config you sent, remove all the set-role commands, and in ClearPass return the Aruba-User-Role attribute with the role name that is defined on the Instant AP. Mapping will happen automatically, no config needed.
Also, be aware that roles are CaSeSENsiTivE. So returning Employee from ClearPass while you have employee with lowercase configured, it only works if you have an exact match.