Hey, every single user on an Aruba wireless network will be assigned a user role. A user role can be a set of firewall rules, VLAN's, attributes and so on.
The behaviour you are describing is when a template Guest network has been deployed and inovles a Captive Portal despite not being required in your enivroment.
The AAA profile is for authenitcation, so despite no AAA server being used, you are still using psk to authenticate to the BSSID.
I suspect that your clients are being assigned the "logon" role as detailed in the AAA profile. See below for an example
Lab620) #show aaa profile weebox-PSK-aaa_prof
AAA Profile "weebox-PSK-aaa_prof"
---------------------------------
Parameter Value
--------- -----
Initial role logon
Can you run the following commands. This will identify the user role assigned to the end user and also the firewall rules applied to this user.
show user-table | include XXXX (MAC of your client)
The above will show the user role assigned to your user
show rights XXXX (where XXX is the user role
The above will show the user role and firewall rules assigned to the user.
Post the output here for us to review.