You can use interface bridging to accomplish what you’re saying although I believe bridging has it’s inherent security holes. The best way to accomplish what you want would be through the use of vlans with default gateways multi-homed on your captive portal interface. Zeroshell also has vlan features that you can enable on the user creation page with 802.1x.
I’m guessing since you didn’t try implementing this first that you probably don’t have a lot of experience with vlans. Esssentially a single ssid and multiple vlans for Guest, Staff, Training.