@keyser the authenticator application is called authelia. All incoming traffic passes through PfSense then the majority goes to my NAS that runs several applets. One of them is traefik which acts as the networks proxy server. All apps are resolved internally via PfSense (so, when internally I go to audiobooks.mywebsite.org it doesn't leave the network. Anyway, that's separate from this.
A captive portal is just a webpage that requires authentication of some kind to proceed to connection. I'm just creating an airlock system in my network that also notifies me of new connections. It's essentially nothing fancier than what is effectively 2 captive portals wherein you can't reach the second without passing through the first.
All of this was pretty well explained above. And repeatedly.