Hardware switch - dot1x

Hi

To do dot1x on a client directly connected to the firewall, the model needs a hardware switch.

I believe you can only have one broadcast domain/vlan on the hardware switch

So, by default does this mean there is no way to have clients sitting in different vlans, or is there a workaround/solution to this. 

Thanks