RADIUS or RADSec: which should I use?

Use RADSec if your equipment supports it, and standard RADIUS if it doesn't. That depends on the make, not on whether it's a switch or an access point. Cisco Catalyst 9000, ArubaOS-CX, Junos and Arista EOS do RADSec on wired ports. UniFi switches, Meraki MS switches and a lot of older equipment don't. VPN gateways use standard RADIUS.

RADSec is RADIUS inside a TLS connection. Everything is encrypted, both ends check each other's certificates, and the site's equipment connects out to us, so there's no inbound port at the site. The connection stays open, which makes it fast: a device joins in a couple of seconds.

Standard RADIUS dates from 1997. It runs over UDP and is protected by a shared secret, which only hides the password field. The rest of the packet, including usernames and device identifiers, is sent in the clear. With EAP-TLS the credentials are inside the TLS handshake, so they aren't exposed. The usernames and device details are, and anyone who reads the switch config has the shared secret.

In short, RADSec is encrypted, uses certificates, needs no inbound port and is faster. Standard RADIUS works on equipment that doesn't support RADSec, and its shared secret needs looking after like a password.

Wireless isn't tied to RADSec. Plenty of access points only do standard RADIUS, and a UniFi SSID can use either. They're two transports, not one for wireless and one for wired.

You turn them on per site, on the site's Transports tab, and a site can use both. On UniFi that usually means RADSec for the access points and standard RADIUS for the switches, which is how we run our own. On Catalyst or ArubaOS-CX it can be RADSec everywhere.