External Captive Portal sends to agreement page and device can't be blocked after

[arosenblatt]

I'm attempting to set up an external captive portal for our Fortigate 51e (5.6.2). But, instead of sending a connected machine to the captive portal, it presents them with the disclaimer/user agreement page and then lets it through. When I then disconnec the machine and delete its definition in the web ui, it's still just allowed through.

So: 1. How do I get the Fortigate to actually send users to the external Captive Portal page? 2. How do I subsequently strip a device of its access rights?