Dear,
You must create a WPA2-ENTERPRISE (802.1X) ssid to get the username
password prompt.
Although not scalable, you can assign different roles based on different
local usernames to give different privileges to clients.
Its better done and scalable through Clearpass or 3rd party radius server