Unexpected guest ?
He will find the login page where you can indicate : "call me, I give you a login code/password or voucher" ?
Does this unexpected guest really tries out guess an access code ?

This will help me identify when an unexpected guest is authenticating and needs action/blocking.

Some one who hasn't access, doesn't have the code, will hit the wall.
You will see this in the portal log :

he can try all day long, to the end of time.

You are creative ? Then two lines of PHP won't scare you.
Here is a suggestion.
Edit /usr/local/captiveportal/index.php

Find this at the end :

Add these two lines :

		$msg = "No access : {$cpzone}, {$user}, {$clientmac}, {$clientip}";
		notify_all_remote($msg);

Like this :

From now on, when the portal login fails, you get a notification.

Why isn't this implemented by default ? For reasons that can become obvious to you : you'll get bombarded with notifications if you have a "unexpected guest" who refuses to use his brain, and starts a dictionary attack on your portal.