Hakim,
as this is quite complex question I'd recommend you to contact one of our sales engineer trained in providing integrated solutions.
This will cover whole design plan and will provide better application of Captive portal features.
In short - you should keep the traffic locally bridged in guest VLAN (walled garden), then use i.e. post-authentication-vlan to distinguish between non-authenticated and authenticated clients. Authenticated vlan might be tunneled to your domain or anywhere you need. Non-authenticated will be soft-locked in walled garden.
DHCP is matter of design but this is not blocked by CaptivePortal so it might be external source.
Regards,
Ondrej