One solution could be to use IAS (the Microsoft RADIUS server). You can configure the zeroshell’s captive portal to authenticate against it instead to use the Kerberos KDC integrated in the domain controllers of AD. With IAS is then possible to select the users you want to authenticate.
Regards
Fulvio