This question is a little convoluted, but you seem to have conflated network authentication methodologies with SSL (TLS).
- WPA2/ Radius is not a proxy, so MiTM is not applicable.
- SSL / TLS provides end-to-end encryption for data content. How those packets are routed in terms of WiFi is irrelevant.
Think of it this way: you have encased a letter in an 800 pound safe. You can move the safe from point A to point B using a train (ethernet) or you can do it via an airplane (WiFi).
In both cases, the mode of transportation is irrelevent to the message (the letter) it's protection (the safe) and its delivery.
Your radius server simply acts as a registry of allowed train depots and airports from which the letter in the safe can be dispatched.
If you're concerned about the "burden" of users having to remember their password to access your network, then you're going to be sadly disappointed in man-kind. It seems to be a prerequisite for users to complain about their passwords and the inconvenience of having security. Security and ease-of-use are diametrically opposed. So, you have to compromise between having great security (encasing your wifi in concrete and sinking it to the bottom of the ocean) and having usable wifi (open, unencrypted, click to connect house of internet disease).
If you're willing to front-load your efforts, you can make it "easier" to connect to your wifi by implementing radius that uses RSA or other key encryption. To the user, that's "click to connect" easy because all the authentication is done behind the scenes.
If you can't (or are unwilling) to do this, then you need to tell your users they are going to have to remember their passwords. If the users are employees, then it's their tough luck that they have to put "effort" into their job. If the users are customers, then you have to make a judgment call on how much security they are willing to put up with in order to access network resources and where your liability is. Users probably won't let you setup RSA, nor will they want to type in d892la0as9jfm10-9svnm as their password.
In either case, RADIUS does not a proxy make, and therefore, MiTM worries are baseless.