External Captive Portal sends to agreement page and device can't be blocked after

I'm attempting to set up an external captive portal for our Fortigate 51e (5.6.2). But, instead of sending a connected machine to the captive portal, it presents them with the disclaimer/user agreement page and then lets it through. When I then disconnec the machine and delete its definition in the web ui, it's still just allowed through.

So: 1. How do I get the Fortigate to actually send users to the external Captive Portal page? 2. How do I subsequently strip a device of its access rights?