First you must make your own database for the list of Users on your XG device , You may use AD server or manually insert the Users one by one . We also do have an option to import the List of users Via CSV file . The Knowledge base article is Provided below.
Next Step is the configuration of the Captive Portal , Please refer the KB article, https://community.sophos.com/kb/en-US/123592, As for the firewall rules make sure there is no rule that is bypassed the users by removing the option "Match rule based on user identity". If that is enabled and the bypass rule does not exist then the Captive portal should pop up on while browsing any website.
We would need one more rule to allow Service of DNS which have no restriction nor "Match rule based on user identity" enabled with action Accept.
For additional information regarding the configuration . Please refer our Website for Sophos XG .
Make sure to create a proper web filter were you attach this URL group, then attach this web filter to a top firewall rule where even unauthenticated users can access it.
Make sure to allow also dns traffic if your clients are using public dns. Regards
Captive portal is to be used when it is a stand alone device, (no server attached) and you want to control the way users surf the web or want to put some restriction on user or control granular restriction using the HG firewall
Am also new, but have read so many material on this aspect
