Client Supplicants will just reconnect a user that has been disconnected or deauthed. It it is better that you blacklist a client and then un-blacklist a client if you want them truly disconnected.
If you just want to log out a captive portal user, I would type "aaa user delete mac <mac address of user>"