What is everyone doing for wireless authentication nowadays?

Healthcare vertical, Cisco wireless, 2504 controllers, 1600 and 2700 series access points. Currently still using wpa2-psk...I know, I know.

Tried setting up a RADIUS server with machine auth but its giving us fits with the certificates. I know its more of a 'legacy' setup anyway. For example, every guide I've looked at for setting up NPS and Cisco is almost 2 to 5 years old.

Outside of going with a solution like ISE or ClearPass which we wouldn't take full advantage of, what are others doing for more robust authentication methods? Our main goal is to keep devices off the network that we haven't approved.