For anyone who reads this, my original post did not really address the question.  First, the OP was using EAP-FAST - my mistake!  I was thrown off a bit, due to the mention of certificates, which are rarely used with EAP-FAST.  Second, there is not a way using Local EAP to require that the device has a certificate, while also requiring that the user log in in some way.  There is a way to do that, but that requires using a Cisco ACS with Machine Access Restrictions.  Device only authentication could be accomplished using EAP-TLS for the device.  Or, with ACS and MAR, the device could use EAP-TLS and the user would use EAP-TLS (if using a Windows supplicant).  If you needed to have different users log into the same device, you would either need to have each user's certificate pre-loaded (those who would potentially be logging in), or you could use the Cisco SSC client and use EAP-TLS for the machine and PEAP or EAP-FAST for the user.  Not typically done, but it could be.