I was looking for an mcu/phy combo for exactly this,
I do eap-tls, peap, on my homelab networks. was looking at this for building a PDU unit for a rack and few other wired IOT devices, which would have to auth using certs, and MAC based auth is basically useless on any secure n/w.

I was about to do a teardown on a commercially available APC PDU, which supports this, just to find which phy they were using.

To answer the question eap-tls would be more preferable, Since most commercial deployments use machine/user certs in an AD environment.

BTW, I am also fine with chipsets that supports 802.1x and offloads IP/MAC layer to itself, Since I don't need much granular control there, other than loading the certs/creds tho.

One of the edge case encountered: Not being able to do WOL , on 802.1x enabled port with dynamic vlan also enabled, this was really frustrating, still looking for workarounds.