Chromebooks are a little limited on resources and some of them do not perform very well in a WLAN. I've seen many customers struggling with these devices mainly because they want them to be connected securely, however in order to apply or push a profile they need to be connected to the network first. Here are a couple of tips that will save you time:
Connect to an open or unfiltered network temporarily while you set up your devices. You can remove this network from the list of preferred networks later by following the instructions to forget a network at Manage Wi-Fi networks.
This could be your guest network or a "on-boarding" network protected with an access code for example.
Apply Wi-Fi networks by device instead of by user. This ensures that devices can access your Wi-Fi network at the sign-in screen.
If you apply the profile by user instead, every time the user signs off will disconnect from the secure network and will need to connect again to any open network, like the Guest or On-boarding. IF the profile is apply by device, the Chromebook will stay connected at all times.
PEAP is easier to deploy because of the fact you don't have to deal with personal certificates, I've found that things get even easier if you apply a generic account to the device, so users don't have to type in credentials every time the device moves to another hands (PEAP credentials), the user still needs to sign in with the google account though.
I hope this can save you some time, thank you for reading.