A gate at the entrance, not the whole fence
A captive portal is a web page a network automatically redirects a newly connected device to before granting it real network access — a login screen, a terms-of-use acceptance, a payment step. Until the device satisfies whatever the portal requires, its access is restricted to reaching the portal itself and little else, which is what stops a device from simply connecting and immediately reaching the wider network unchecked.
But the portal is only the entry gate; it's not the isolation itself. Passing through it should grant access to the internet specifically, not incidentally to every other device sharing the same network — a captive portal placed in front of a genuinely unsegmented network checks who's coming in without doing anything to keep them separate from what's already inside once they're through.
Isolation has to be a property of the network, not just the login screen
Real guest network isolation requires the network itself to segment guest traffic from anything more sensitive — a household's own devices, a business's internal systems — regardless of what the captive portal alone checks. A guest who's authenticated correctly and reached the internet exactly as intended can still, on a poorly segmented network, potentially reach a printer, a file share, or another guest's device that was never meant to be visible to them at all. The captive portal answers 'who gets on the network'; the network's actual segmentation answers the separate, equally important question of what they can reach once they're there.