The client will show connected even if they're not authenticated.
That's because connection to the SSID is not the same as authentication through the splash page.
If you have all of the appropriate settings set to block, the client should be able to connect to the SSID but not be able to reach anything until authenticating through the splash page.