Gary,
If you are not going to use System or Login window mode, then you can use IPCU to create the 802.1X profiles that will allow a Lion client to connect to either a wireless or wired 802.1X network. If you need System or Login window mode, then yes, you will need to set up a Lion server or use the networksetup utility.
From my testing I have found the following to be true:
1. A profile created with IPCU can be used for either the wireless or wired interface on a Lion client. If you want to create a wired profile, just enter bogus info for the SSID, the wired interface will ignore it. If you decided to check out Lion server, you can specify wired or wireless interfaces, so you do not have to enter a bogus SSID if you want a "wired" only profile.
Another thing is again with Profile Manager (Lion Server), WiFi 802.1X profiles can be used with wired interfaces, however, wired 802.1X profiles CANNOT be used with WiFi because it lacks an SSID.
2. Lion client now supports an "802.1X automatic" mode with wired. Meaning, if you plug a Lion client into a switch that supports 802.1X authentication, the Lion client with start the EAPOL supplicant when it sees an EAP ID request. If, the EAP type can be auto neg by the Lion client, it will prompt the user to enter user credentials, or a cert (in the case of TLS). So a profile is not needed in this case.
If this auto connection mode is not desired, you can turn it off by going to System Prefs - Network - choose the Eth interface - advanced - 802.1X tab. You will see a check box to enable automatic connection.
Hope this helps