It looks like the client is connecting via EAP. I can't seem to find anywhere in the controller to force it to PEAP. Playing with the NPS server I was able to add "Microsoft: Smart Card or other certificate" as an authentication option which now allows the clients to connect, but somehow I feel that's not the proper setup.