Hey Pete,
A few questions:
1: Are you only planning to secure unused ports with NAC...???
2: Do you currently have specific VLANS or Subnets for the unused
ports/Employees...???
3: Is there a reason you want to go OOB...???
Pending your answers I can give you some advice.
Chris