Solved! Actually, this is achievable with combination of "post-auth" timeout and account lifetime & session time; having one shared guest account with unlimited acct lifetime & session (both set to "0"), idle (post) = <grace-period> will remove the authenticated device from list after X minutes of idle (no frame).