802.1x can be tricky, as the problem could very well lie in your client config/NPS config and not with the AP/WiNG specifically.
Within WiNG, to use an external RADIUS server for WLAN Authentication, you would want to set the SSID to authentication-type eap and tell it to use the aaa-policy you created. The AAA-policy just needs to be fed the server IP and the secret.
ex.
aaa-policy LabTest
authentication server 1 host <ipadr> secret 0 <secret>
wlan LabTestWLAN
ssid LabTest
encryption-type ccmp
authentication-type eap
use aaa-policy LabTest
At this point, the AP is configured to act as an 802.1x authenticator. The AP would then need to be set as a valid RADIUS client within NPS, having the correct secret isn't enough there. eg. Configure RADIUS Clients | Microsoft Learn
Once that's all in place, you then need to start thinking about EAP methods and your client configuration with regards to certificate validation. You could have everything from the above paragraph's setup properly, but if your client device is set to validate server certificate trust and the cert being offered by your NPS is not trusted by the client, the client will never proceed to send it's credentials to authenticate.
