SNAC 12.1.4 works with Cisco ISE across multiple physical sites

The client has two sites, connected by two firewalls. We have one SEPM to manage two sites. They also use Cisco ISE to do the ID authentication, and SNAC as host integrity check. We know we will treat the Cisco ISE as the Radius, let ISE to decide which production VLAN PC will connect. The question is that: SNAC's host integrity check is managed by users, no matter whether the user is in site A or site B. However, we need to assign the VLAN based on locations, or which physical Cisco switch this PC connect. Cisco ISE will do the ACL for this user no matter which VLAN he is assigned.

Is there anyone who can advise what the best practice or how to configure when SNAC need to work with Cisco ISE across multiple physical sites?

Thanks,

Henry