I use a mac and the same issue is there; all I do is override the DNS on the wireless connection to use 8.8.8.8. In systemd-land, I'd expect that to be in /etc/systemd/wireless.network:

    [Match]
    Name=wlan0

    [Network]
    DNS=8.8.8.8

(other settings omitted). However, DNS hijacking isn't necessary for a captive portal - they can reroute port 80 traffic and respond with 511 per https://tools.ietf.org/html/rfc6585#section-6, (quite common now as the interaction is better for non-browser phone apps) or advertise the login page via DHCP as in https://tools.ietf.org/html/rfc7710.