You can use the usb port, or connect locally to the switch and uplink via a direct connected ethernet port.
BUT...
There is no need for manual installation anymore.
From the manual:
To improve the ease of deployment, Aruba switch allows automatic downloading of the root CA certificate of ClearPass servers. As a part of the ZTP process, if the configuration of the switch is provided with an additional keyword ClearPass in RADIUS configuration, the switch will contact ClearPass and download the root CA certificates. This simplifies use cases such as Downloadable User Roles as well as Device Fingerprinting with ClearPass
Please read the latest Access Security Guide for ArubaOS-Switch guide,you will need certain firmware levels on both switch and clearpass.
Config Example:
# radius-server host <IP> clearpass
# crypto ca-download usage clearpass retry 3