Does this cover wired as well as wireless?

Yes, and the wired half is the one everybody forgets. A network point in a meeting room lets anyone on unchallenged — 802.1X on a switch port is the same certificate check as on the SSID, and the same certificate does both.

Wired is proven on real hardware, including putting an authenticated device onto a different VLAN from an un-authenticated one on the same port. See “How do I make a switch port default to Guest, but put authenticated devices on the staff VLAN?”, and read “Why is my Windows PC ignoring 802.1X on an Ethernet cable?” before you test anything, because it will otherwise be the first hour you lose.