I agree with Colin, since users are ending up in the correct role on the Aruba controller, this would appear to be an issue with the captive portal enforcement device (checkbox).
What is the size of the DHCP scope for your guest users? If you have 200 users associated, are they all able to obtain IP addresses? If the DHCP scope is undersize, users not receiving an IP address will not be able to attempt to bring up the captive portal.