The AP itself only passes on the EAP messages from your client to the radius server via radius auth packets.
When reading your explanation you can only set the credentials with an admin account, so the regular user is not logged in. So there is something on the OS side that is preventing the user for entering and saving their credentials to the Wi-Fi profile.