You can generate a session key and store it in a cookie client side which is contains a session token to authenticate the client to the Proxy (yes proxy!). (do make sure it's sent over HTTPS as otherwise it's completely useless)
The proxy does bring a limitation when it comes to other types of traffic such as SSH (taking out of scope that your users know how to tunnel traffic over HTTP). To solve this problem you can step away from the whole 'captive portal' story and try another authentication method like PEAP.
Note that setting up a good way of authentication is not easy as there are many ways of bypassing captive portals. Some are for instance:
- DNS Tunneling
- ICMP Tunneling
- HTTP Tunneling (if you want to disallow
Securing these is not easy and not all captive portals can be secured equally well. My preference is EAP-PEAP or EAP-TTLS.