Very ineffective solution for this type authentication, currently any manageable switch has option to enable packet switching only between selected ports (and is same with wirelesses, you can set that clients don't communicate directly), just use firewall plus few scripts and solution ready.

For universities there are thing as eduroam, which works like following: 1. there are 802.x authentication with certificates and users + password; 2. for legacy clients just landing page with firewall tricks