You have created an outbound rule, is traffic allowed to the radius server from the Meraki APs/cloud etc.? You need an inbound rule to it. In terms of the behaviour it is expected as the RADIUS server is unreachable and you have said to allow access if that happens, hence they can type anything.
If my answer solves your problem please click Accept as Solution so others can benefit from it.