The list you want isn't in the PDF, it's in the online Access Security Guide under User roles, Overview, Restrictions. That's where the legacy secure client access piece is actually spelled out: no BYOD redirect, no MAC auth failure redirect, no enhanced web auth, web auth can't share a port with other methods, and both auth-vid and unauth-vid are out.
On the VSA side, your VLAN attributes aren't being ignored exactly. User roles are a global enable and the role gets applied to every user on ports where authentication is configured. If the Access-Accept comes back with VLAN attributes but no user role VSA, the switch counts that as no role returned and drops the client into the initial role, which is denyall unless you changed it. From the outside that looks identical to the VLAN being ignored.
Put the VLAN inside the role with vlan-id or vlan-name and it works the way you want. As for mixing, it's all or nothing per switch since there's no per-port enable, though local roles and downloadable roles can happily coexist per client.
------------------------------
Dustin Burns
@Worldcom Exchange, Inc.
If my post was useful accept solution and/or give kudos
------------------------------