The way in which the BIP141 segwit guidelines think about transactions is solely that each transaction enter (even non-segwit ones) have a witness stack. Non-segwit inputs are required to have an empty witness stack nevertheless.

If each transaction enter has an empty witness stack, the previous pre-segwit transaction serialization is used for the transaction. If no less than one inout has a non-empty witness stack, the BIP144 transaction serialization format (together with marker & flag) is used. The non-segwit inputs then merely have an empty witness.

Now, there’s a consensus rule that claims that until a transaction enter is a segwit spend, its witness stack should be empty. An enter is a segwit spend if the UTXO it spends is a witness program (OP_n + push of 2-40 bytes), or if it’s a P2SH UTXO, whose redeemScript is such a witness program. If an enter is a segwit spend, the scriptSig should be precisely empty or precisely the P2SH redeemScript and nothing else. If an enter is not a segwit spend, the witness stack have to be empty. However all of that is guidelines that govern whether or not a transaction is legitimate w.r.t. its witnesses and scriptSigs; it’s unrelated as to whether the transaction has witnesses.