Figured it out. 

If anyone is interested: 

1.Choose the role under Clean Access > General Setup > Agent Login. 

Choose MAC_ALL to configure the agent requirements for iPhone or iPod 
touch. Make sure the Use ALL settings for the MAC OS family if no version-
specific settings are specified is unchecked, so it will not use the 
shared setting from "ALL". Also, make sure the Require agent downloading 
option is unchecked.

Choose MAC_OSX to configure the agent requirements for MAC OS. You can 
check the ALL settings option or uncheck it to configure this specific OS. 
The Require agent downloading option must be checked if you want the 
regular MAC OS users to download the MAC agent.

I have tested this and it works fine. Ipod/itouch will work with just a 
username/password and MAC's need to download the agent.