This can be done by using policy based authentication. Radius server can authenticate multiple devices on same port and reply with vlan id tagged or untagged for the mac. Device will get data vlan as untagged while Phone will get VOIP vlan as tagged. Only one thing, need to manually set vlan id in the phone in dot1.q settings
I found the solution. I had to change dot1x prot-control from auto to mac-based.
mac-based is explained like this:
MAC-Based – This mode allows multiple supplicants connected to the same port to each authenticate individually. Each host connected to the port must authenticate separately in order to gain access to the network. The hosts are distinguished by their MAC addresses.