Cisco ISE will communicate with the JSS on the port the JSS is configured to run on. In a JAMF cloud instance this will most likely be port 443. The port is configured in the "MDM Server details" within the "External MDM" section of ISE.
Interesting. We are using AD as our identity credential for ISE(802.1x) authentication which is tying my hands on fighting against AD bind but if I could cajole ISE/Casper into using something else as the identity credential without too much hassle maybe I could convince the ISE team to let us implement it.
Are you on slack? If so can I poke you a bit more about this scenario?