A company wants employees to onboard their personal devices for secure network access. When users connect to the corporate SSID and authenticate, they should be redirected to a portal that guides them through installing a supplicant configuration and issuing a certificate to the device, after which they gain full access. Which ISE portal type must the administrator configure to accomplish this device onboarding workflow?