Relevant answer to an existing question here: Can a captive portal be secured
You can generate a session key and store it in a cookie client side which contains a session token to authenticate the client to the Proxy (yes proxy!). (do make sure it's sent over HTTPS as otherwise it's completely useless)
The proxy does bring a limitation when it comes to other types of traffic such as SSH (taking out of scope that your users know how to tunnel traffic over HTTP). To solve this problem you can step away from the whole 'captive portal' story and try another authentication method like PEAP.
Note that setting up a good way of authentication is not easy as there are many ways of bypassing captive portals, for instance: DNS Tunneling, ICMP Tunneling, HTTP Tunneling
Apparently some routers have a 'Client Isolation' or 'Wireless Isolation' setting which may prevent devices on a network communicating with each other (mitigating any ARP poisoning attack).
WPA2 Enterprise could also be implemented which encrypts traffic at a user level, using each member of the networks unique credentials (username and password).