TL:DR No. You will need the PEF-NG license. 1 per AP.
If there is no PEF license users all get the same role once associated, therefore you cannot have a logon role to enforce captive portal AND an authenticated role once the guest user has logged in.