If you are trying to switch the users vlan after they have authenticated via a captive portal, then that is fraught with difficulties. It is possible, though I would not recommend it.
The problem is that the device already has an ip, and then it's vlan is switched. It may take devices some time before they realise and then do another dhcp request, with some devices never realising and then never having any network.
There are some other post in here which have some neat workarounds, but they are sort of fudges.
I would recommend only changing a users vlan via radius attribute with a dot1x ssid.