Elena, this cannot be done. First, I wrote an ArubaOS 6 book a couple of years ago and I created a role derivation flowchart which shows the role derivation logic. Go to www.westcott-consulting.com and download the free files that I have made available. You will be signing up for my mailing list (that I rarely use) and you can remove yourself. This just validates that you are a person. You will get an email (check junk area) which will provide a link to download.
You can do MAC authentication followed by 802.1X/EAP. If MAC fails, with L2 failover, 802.1X/EAP would still process. If MAC fails, without L2 failover, you are disconnected. However, if it moves past the MAC authentication stage either with a success or with a failure and L2 failover enabled, 802.1X/EAP will be processed.
With wireless you cannot do either or. With wired, you typically can do either/or.
I hope that helps,