I will try to answer all of your quesitons:
1. "With the standard port configuration, is it better to have the switch ports on vlan 40 (guest vlan) by default, and have the corporate users NAM supplicant change the vlan to 20 if successful, or the other way around and have the ports in default state on vlan 20 (corporate) and when a guest hits the web portal have their vlan changed to vlan 40"
- I suppose the standard is to have the port in the regular/standard VLAN and only put failed authentications in the guest VLAN. However, with that being said, it really depends on what you are trying to accomplish, thus I suppose you could try doing it the other way around. I have never tested it nor deployed it that way so I highly recommend you try that in the lab
2. "I wanted to know if the change of vlan for corporate users with NAM is reliable?"
- Yes it is. Well at least for the most part Some "dumb" devices such as printers, badge readers, etc, might not know that a VLAN was changed, thus never request a new IP address. As a result, they get stuck in the guest VLAN. That is why I usually like to NOT use guest VLAN but send all failed authentications through the guest portal. There you can control who is guest and who is not via dACLs.
3. " We also plan on implementing low impact mode, ie open authentication with a default ACL as there are things like PXE booting that needs to happen"
- So my guess is that the guest VLAN terminates on some interface such as FW DMZ. That interface usually has some ACL that blocks all RFC 1918 and permits everything else. If that is the case and you want to use Low-Impact mode, then you will need to grant the same access on the DMZ interface as the one granted in the Low-Impact mode ACL otherwise things will break
