If this is a wireless configuration you don't need to do anything on a switch. I'm not sure I fully understand what you are doing, but it sounds like you are having an issue with the Authorization Policy. When you look at the ISE Operations>Authentications what Authentication Policy is the successful Authenticaiton matching? It sounds like your not landing on the right authorization policy.
We have configured the outside and inside Interface with official ipv6 adresses, set a default route on outside Interface to our router, we also have definied a rule , which also gets hits, to permit tcp from inside Interface to any6.
In Syslog I also se...