I will start by saying that while some access points can be configured as a client to authenticate to an 802.1X protected switchport, not all can. Further, you can't enable 802.1X on a trunk/tagged port, so you won't be able to do this if you have an access point configured to handle multiple VLANs (i.e. multiple SSID/VLAN mappings with an autonomous AP or some vendors with 802.11ac are moving away from tunneling all traffic back to controllers).
I am not aware of an access point that will work in a "multiple session" mode as you describe. I think the first hurdle here is that the AP functions as a NAS itself, so the client is already authenticating to the network. This would potentially require a second 802.1X authentication by the client to the switch.
The second hurdle is that this would break any ability to run multiple SSIDs on different VLANs or to have the AP management IP address on a separate VLAN than the users. In a "multiple session" mode typically all devices must have the same VLAN assignment or they will be denied access.
Ultimately access points are part of your infrastructure and you should always look at physical security for all infrastructure. How are you securing your switch to switch links that are not participating in 802.1X? This is a security vulnerability as well if not secured properly.
For instance, I would start with some sort of cable locking device such as this one from Panduit. While not perfect, at less than $10 per AP it does make a cable much more difficult (either accidentally or from tampering) to remove without the "key" tool.
If you wanted more security I would use an enclosure to contain the AP and cabling. These will range from about $50-300 per location and provide differing levels of security (depending on make/model). If you go with a metal enclosure, you will need to use an external antenna to prevent the enclosure from interfering with signal, which may add additional costs.
