most browsers block the popups
Why not explaining on your main Portal web page that users should/could use IE->Utils->Blocking popup windows->Parameters to block publicity-> [
add the
opt1 IP : i.e. 192.168.2.1] so they would receive a 'disconnect' windows, from pFsense only.
By the way, pFSense & FreeRadius (a windows server process) rocks..... But don't look for time limited features in it - it isn't any great use if prepaid functionality is needed.