curiousguy is correct that Tor doesn't actually obfuscate the protocol other than HTTPS. Of note, however, is that Tor (using something like Tor Browser or Vidalia) does proxy DNS requests through Tor.
Some captive portals work only by redirecting default DNS to a login portal. If this is the case, the combination of encrypted communication and third-party DNS could subvert the captive portal. That said, changing DNS manually to something like 126.96.36.199 (Google public DNS) and browsing HTTPS pages, using a VPN, SSH tunnel, etc, would also subvert this portal.
Tor isn't doing anything on the protocol level to fool a captive portal, but it's certainly possible that when used in the way you describe that it could allow a way out of the walled garden.
how would I prevent it when setting up a captive portal?
Most captive portals will not be vulnerable to this type of attack. All you need to do is successfully block all egress requests other than HTTP, which is forwarded to the portal login page; basically, nothing should get through the portal unless it's an authenticated client.