I am not sure of any commercial implementation, but I saw an interesting idea that you can track physical proximity using signal strength, which AP, etc and determine that if the location suddenly is very different, that is likely a spoofer. I also found an interesting paper on spoofing detection using a fingerprinting technique.
The captive portal will be a web page. You may or may not be blocking all other ports before authentication, let's assume you can only get to 443 (80 redirects to 443) and only allow HTTPS. At this point they can only get to your captive portal page. Once they agree to the terms, log in, etc. you then can open up the other ports and allow web browsing anywhere they need to go.
If you are in a corporate environment, you will probably want to be implemented 802.1x, certificates, VPN, etc. to let them go anywhere and only keep the minimum ports open for authenticated users. VPN either at the IPSec or a higher layer would make the spoofing issue less likely. This allows you to restrict access where it won't matter if they spoof the mac, because they still can only get out to the VPN, and would need to attack the VPN.
If you are a hotel where you are tracking people by room number, spoofing the MAC would give someone a free ride, but it ends after the time period for which the legit user paid. You could implement something at the web proxy level to check certain cookies, headers, etc that will be more client specific.
The main security challenge of wifi is that your on an open network unless you are doing per-host type encryption (e.g., VPN). A MAC address should never be considered sufficient to identify someone.
Here are some resources related to security and captive portals: