The 5G core expects to authenticate a subscriber and manage sessions. It does not, in principle, require that the subscriber arrived over 3GPP radio. The non-3GPP interworking function is what allows a device on a Wi-Fi network to present itself to the core as though it had.
The device establishes a secure tunnel to the interworking function over whatever IP connectivity it has. Signalling that would normally traverse the radio interface is carried inside that tunnel, and once established the core treats the session much as it would a cellular one — same identity, same policy, same session management.
The distinction that matters is trusted against untrusted access. Untrusted access assumes the intervening network is hostile and secures everything end to end to the interworking function. Trusted access, where the operator has a relationship with the access network, permits a lighter arrangement. Most enterprise deployments are untrusted, because the operator does not control the Wi-Fi.