Well to be honest i’ve done this long time ago but
go
Captive Portal/Authentication and in segment Authorized Domains
for Default Radius request chose PEAP with MsChap v2 or EAP-TTLS with PAP
I am not sure for the second one EAP-TTLS but try it out
Then as I can recall radius is only going to ask for username and password
Users must be added in Users segment
hope this helped