How do you handle wireless clients that do not support TLS?

I work in healthcare. We have an absurd number of archaic devices that do not support installing certificates to use EAP-TLS. We're in need of a wireless redesign to reduce SSIDs, etc.

I was wondering how you handle wireless devices that only support open or PSK. We have cisco 3700s and WLCs. We also have ISE and Prime. I've been considering walling an open SSID via DACLs with ISE, but I'm also not certain that all of the devices support no PSK. My biggest worry with the PSKs is that it's not necessarily the most technical group that deploys these devices and having sticky notes on devices with the PSK is not out of the question.