Yes, in the no-auth role you only allow...
- The IP of the controller guest_portal topology = allow to access the portal
- DHCP = to allow the clients to get a IP from the controller DHCP server
- DNS = to allow name resolution, only if name resolution is allowed the clients will be redirected to the portal
- The return direction of the traffic