I had the same question. The captive portal first presents the LN invoice. Then:
In my app, I allow them access for the first minute or so and they can complete payment. Obviously you need to track it so it's not abused.