Yes, that is possible.
Set the topology for the non-authenticated role to either routed or bridge@EWC (traffic thru the controller) and as soon as the client has put in username/password he'll get the authenticated role.
For this role use a bridge@AP topology.
Here a "normal" example...
https://community.extremenetworks.com/extreme/topics/how-to-identifi-wireless-appliances-guest-porta...
So just change the topology in the "2) create roles" section.
!!! you should use a very low DHCP lease time on the first toplogy, so if the client is switching roles/topology that he'll renew his IP !!!
-Ron