So there is a NAC variant to that document, but was not authored by me, so I've asked for it to be posted also.
However, the approach with VOSS to the edge, is not to have to configure anything on the switch anymore, so not the same workflow as what you would have been used to with ERS.
VOSS will bootup and automatically joint the Fabric (ZTF = Zero Touch Fabric) and then if it can get an IP (inband over onboarding I-SID, or oob) it will then do ZTP+ into XIQ-SE.
XIQ-SE can then provide the final config touches to the VSP switch, such as flipping it to DVR-Leaf (if you so choose), setting certain auto-sense global parameters (e.g. voice I-SID) and if you need to do NAC on the switch, adding it to XIQ-SE's Control Engines and configuring RADIUS + Eapol globally on the VSP. As of XIQ-SE 22.3 the previous steps are automated, and can also be automated via an "Onboard VSP" workflow you can find on GitHub.
The point is there is no port level EAP/NEAP config to be done. All the VSP ports are auto-sense enabled, and it is enough for a RADIUS server to be configured on the switch and that EAPoL is globally enabled, and the auto-sense ports are ready to go for both EAP and NEAP.
If you really wanted to see that config, you can always let the auto-sense port settle into UNI-ONBOARDING state (by connecting a end station to the port) and then issue on the port "no auto-sense enable convert-to-config"; you will then get the current dynamic config of the port (with EAP/NEAP settings) frozen into the config file.
Some EAP config is not actually handled by auto-sense, and you can add it as a delta and it will operate with auto-sense; things like eapol re-authentication, eap max-macs, and fail-open. These can all be added during the ZTP+ onboarding.