Our Self Registration set up does require one Open SSID (for clients to connect to while they register) and one PPSK SSID (for clients to connect to once they've received their credentials). However, to get to the set up you are proposing here, I think you might do better with a normal PPSK set up instead.
If you set up a PPSK SSID, you can create different user groups for different users. Once you've created all your users, you can create the PPSK SSID and apply different user profiles to different users based on assignment rules. When you make the assignment rule, you can choose User Group as the classifying criteria. So you can say users in User Group A go on VLAN A with permission set A, while users in User Group B get on VLAN B with permission set B, etc. This is all set up ahead of time, so once you deploy you don't have to do anything else to classify users on to the correct VLANs, and all users connect to the same SSID with their own individual passwords.
Unfortunately there is no way to have them register after they connect. The closest we can get to that is to have them read and consent to a user policy agreement via a CWP after they connect and before they can browse. The only ways to have users sign up for connection is self registration (with 2 SSIDs), or a CWP using social login (not an option with a PPSK SSID, you'd have to use an Open SSID for this).
Does that answer your question? Is there anything I can clarify?
