I'm not sure which Guide/Post Tim is referring to here, but here is a little tidbit...
RADIUS Deny Access on the MAC Caching profile will trigger the client to get the default AAA role on the controller (captive portal).
RADIUS Drop Access on the MAC Caching profile will drop the user from that SSID. No default AAA profile, no captive portal.
Hope that helps.