You can use user derivation rules to give different user-role by mac-address
You can use server derivation rules to give different roles based on user (internal dbase) or radius/ldap attributes for external servers.
Or if you should have clearpass the possibilities are endless. :)