A network engineer is deploying 802.1X wireless access for corporate laptops that authenticate against Active Directory using usernames and passwords. The company has decided NOT to deploy a client certificate PKI on the endpoints, but they still require the RADIUS server identity to be validated by the supplicant during the TLS tunnel establishment. Which EAP method should the engineer configure in the ISE Allowed Protocols policy to meet these requirements?