Can Passbeam authenticate devices by MAC address (MAB)?

No, deliberately — and the refusal is load-bearing rather than a gap. A MAC address is printed on the device and is trivially copied, so a network that admits things by MAC admits anything willing to claim that MAC. Passbeam only ever answers to a certificate.

What actually happens is more useful than a plain no. A device with no 802.1X supplicant says nothing when a port challenges it, so the switch falls back to asking us about its MAC address instead. Passbeam refuses that, and the refusal is what triggers the switch's own Fallback VLAN — so the device lands on guest rather than nowhere. That is the mechanism behind “How do I make a switch port default to Guest, but put authenticated devices on the staff VLAN?”, and it is why an un-enrolled laptop in a meeting room gets guest access instead of a dead port.

For equipment that genuinely cannot do 802.1X, the answer is a certificate rather than an exception: printers, cameras, door controllers and building management get one each, issued by hand from the same authority as everything else, and they authenticate properly. More of that equipment can do 802.1X than people expect — it is usually in the web interface under 802.1X — and if it fails with a TLS error there are two settings that usually fix it.

If something truly cannot, put it on a VLAN that assumes it is untrusted. That is a better answer than teaching the network to believe MAC addresses.