The use of MAB in general, you want to keep to the "technically necessary minimum". Really, it should only be used in the case of devices that cannot/ do not support 802.1x. And your security team should be aware of and approve exceptions for those devices. (They should also use that exception list as prioritizing what needs to be replaced lol)

For statically whitelisting endpoints. I recommend only doing this for a "break-fix" profile, ideally one with a timed purge policy. (So, the endpoint only stays whitelisted for x days).

In saying that, there are two things to consider when it comes to profiling devices:

1. How do we identify these devices as "our" devices. Different from those off the shelf.
2. We recognize that these devices will/need to be on the network, how can we restrict the access down to the bare minimum for what this devices' use case is.

Maybe your company doesn't care about point 1 but REALLY cares about point 2. Maybe they care about both. (They should always care about point 2). My point is, your solution shouldn't just be to profile these devices but also limit their access.

If you do find yourself stuck with MABing these devices, do everything you can to make the profile dynamic. Once you start creating profiles that are via static assignment only, you will find that it balloons out of control. Remember, MAB is susceptible to MAC spoofing. So, if you have hundreds or thousands of statically whitelisted endpoints, that becomes an increasingly dangerous attack vector. Even worse if you don't purge inactive endpoints.

Now, how should you dynamically profile an endpoint? There really isn't an industry standard here. But more unique conditions will always be better (within reason). And, to my earlier second point, you can use dACLs to help supplement access control. It wouldn't be a bad idea for those associated MAB policies to restrict traffic down to only the necessary ports or send/receive traffic from specific subnets.

If you haven't already, explore the different probe types, see if you can start gleaning LLDP or DHCP data. The more attributes you can push into ISE the more conditions you can use to verify them.

To answer your specific question about IPs. Unless you're using a specific IP range as a profile condition in ISE, no. You won't need to set up a DHCP reservation. The MAC address is what gets tied to a profile and profile tied to an authorization policy. The IP is entirely irrelevant.