I use the lightweight solution with 1131ag and 4402 WLC, but the basics are the same. You need a client supplicant that can do one time use tokens. The windows zero configuration client does not support one time use tokens. I use the Juniper Odyssey client, but you could just as well use the Cisco ACS client. Even the old Cisco Aironet PEAP supplicant will do the trick (albeit unsupported). Both supplicants can be downloaded for a 30 day trial if you want to check it out.
I have the WLAN setup to authenticate to a ACS Radius server and use WPA2. The client is setup to use PEAP, with one time use hardware token.
Hope this helps. If you want more details, let me know.
