Its recommended to use the management interface for radius source for authentication, the switch configuration example is below

radius-server key xxxxxx
radius-server timeout 30
radius-server deadtime 60
radius-server host 10.0.x.x key xxxxxx authentication accounting timeout 5
radius-server host 10.0.x.y key xxxxxx authentication accounting timeout 5
aaa group server radius RADIUS1
server 10.0.x.x
server 10.0.x.y
deadtime 30
use-vrf management
source-interface mgmt0
snmp-server enable traps aaa server-state-change
aaa authentication login default group RADIUS1
aaa authentication login console local
aaa accounting default group RADIUS1
radius-server directed-request
ip radius source-interface mgmt0

Authorization profile for Network-Admin Access, if you want network Operator only access then just use network operation instead in Cisco av-pair

ISE Autz result

ISE Policy


Login Verification

Nexus logs

ISE Logs


I hope you enjoyed reading it as much as I enjoyed writing it.