802.1x is port based. So, in simplest form, the port is either authorized or not; once authorized -- MAC limits aside -- traffic from anything will be allowed. Modern 802.1x systems are much smarter ("more complicated") and can independently police multiple hosts on a single port. This is where multi-auth and multi-domain come in. (consult Cisco here)
You would need to configure MAB (Mac Auth Bypass) authentication for the ip phone in the multi-vlan interface. You also need multi-auth so the switch knows to look for more than one MAC address.
-authentication host-mode multi-auth
-authentication order mab dot1x
Typically the MAC address is stored in an EEPROM connected to the network controller. The driver by default reads the MAC address from the EEPROM and tells the network controller to use it. However most drivers offer a way to override this behaviour and use a user-specified MAC address.
The U/L bit is just a convention, intended to prevent conflicts if ...
what I mainly want to know from someone who has already gone through all this is: Is a "MAC authentication" that still generates EAP packets a valid approach?
Here's a freeradius-users thread which answers most of these questions.
The crux is:
Using EAP for MAC auth makes no real sense.
But it isn't bad either if it's at least correctly implemented.
The phone must be able to do CDP. If the switch sees a phone as a CDP neighbor, it will do CDP bypass and will not attempt to authenticate.
Multi-auth is not necessary for a phone. That will allow multiple machines in the data vlan, which is disabled by default and will show "Security Violation" in the logs.
Multi-domain will allow a phone to ...
CDP should actually take care of the port authentication for an Cisco IP phone. There is a little-known feature called "CDP bypass" which allows a Cisco switch to detect a specific TLV in the CDP message which allows immediate authentication. Be aware however, that newer version of Cisco IOS no longer include this CDP bypass feature.