If NAP prevents a non-healthy computer from acquiring an ip address i.e. lacking Windows patches or an antivirus, then how is it able to acquire them conveniently?

Or is it connected to another server exclusively dedicated to this function?