For guest networks, accounts and authentication are typically handled within the controller or ClearPass Guest if you own it. For employee networks that use 802.1X, an external directory source is typically recommended as it already contains the user accounts and passwords. You'll need a RADIUS server to interface between the controller and the directory.
If the environment does not have any external database, the choice is really yours. You could create the accounts internally or externally. If you use the internal DB and are using 802.1X, you'll need to enable EAP termination on the controller in the dot1x Authentication Profile.