Captive Portal Group Restrictions?

[ladiko]

Is it possible to let all users login through one portal, but get different access to websites. let's say we have the following groups:

admin: access all areas
trusted: unrestricted internet access except adult content maybe
general: no social media, no adult content etc.

I played around with squid / squidguard and wpad in a test environment and it works in general, but then we have some kind of vending machines which download updates from security.ubuntu.com and some other servers which then had to be handles separately as it's not our intention to enter an authentification for the download of ubuntu updates through squid especially as the captive portal already has rules for websites which are not blocked.

Is there any way to do that?

If pfSense can't do that, does anybody know another solution? I havent found anything suitable in the commercial area (cisco, linksys), not to mention the free or open source section.