Check the levels of code you are running. We are running the below levels and the integration is working fine. We were initially running an earlier version of XMC/Control and had problems as you are noticing.
Essentially policy takes care of the vlan / isid without any special tweaking. I am having issues getting captive portal to work (in our case it is hosted on control) but the basic vlan assignment & fa works fine.
Glenn, Are you using different VLANs for Guest User registration and Guest Access after the successful auth.? If yes, we have recently discovered an issue that prevents the client from getting IP from a new VLAN even if correct role has been assigned after Guest User registration. It has to do with DHCP packet ACKs when the user is in unauthenticated state. it is being looked at and a fix should be introduced in one of the coming releases. However, you should not have any issues, if the pre and post registration VLANs are the same.
For our captive portal the vlan is the same. We do have a lot of WPA2 Enterprise networks which switch vlans.. is the bug just related to captive portal?