It is best to think of these two features as working independent from one another, completely separate. The ACL is going to inspect the packets and apply the permit/deny rules regardless of if the client is authenticated or not. You can kind of think of it as two body guards for a building. Say your ACL is Ingress, it would be your first body guard. If your on the ACL body guard's lists, he lets you in. But now there is a second dot1x body guard for the second set of doors. To get by the dot1x body guard you need the right password, if you don't have the right password you wont get into the building.  The force-authorized command would be the way to set an interface to not go through the auth/verification process. Or have MAB set on the port and have the clients MAC address stored on the RADIUS server. 
hi, is it possible to have both dot1x & ACL on the same one port? and which one goes first? would an ACL allow a MAC (supplicant without dot1) on a port with "dot1x port-control mac-based" ? best regards 
ACL vs(or along) dotx1 - hierarchy/priority/configurability ?