@Andone ,what a pity!

I hopped this could work because of the 'mac-vlan' commands which do just the same with a local database instead the use of RADIUS.

So technically it should be possible in my constellation, too!?

@PeterS 

Not use VLAN assignment and use MAC-VLAN? Maybe it can work as you want.

@PeterS 

MAB works as Port-Based, yes. As MAB will not work with Guest vlan, it is also a bad solution. Use one more managed switches :)

I feel other vendors, like D-Link, have 'mac_based_access_control' feature both local and RADIUS, which will suit you.

@Andone, surely, it would.

But we're talking about a professional environment with hundreds of MACs and changes every day, so a local database (as i.e. 'mac-vlan mac-address 00:11:11:01:01:12 vlan 2' is) would be impossible to handle. Also, I would guess, there is (implicit?) limit in configuration lines which would limit the entries in the database, also.
 

@Mitya, thank you very much.

Do other vendors offer my required combination of features on edge switches completely?

BTW: Guest VLAN is implicitly possible, too. I made my RADIUS offer this special VLAN id in case of unknown clients. ;-)

@PeterS I know, that D-Link's mac-based-access-control is the same, as theoretically "MAB for MAC-Based", not MAC for Port-Based only. I had a client, which wanted to change dlink with tplink, but tplink didn't support it. Probably, other vendors also have MAB for MAC-Based, need to check deeper.