Yes, you can configure a wireless network with OnBoard. If you provision the client for a WPA2-Enterprise SSID it will create unique device credential (it contains MAC address, OS version, IMEI number etc.) for the user and that will be used in the authenticating process. There is CA server on the Clearpass which will issue this unique device certificate for the user. You can configure this network to only allow connections from the onboarded devices or put them into different roles, disable certain devices (revoke the certificate or do it manually) etc.