Regarding not making it accessible on the internet, I wonder if you could use some Cloudflare rules to handle this at the DNS level?   One unique aspect of the Meraki captive portal is that it passes in a selection of URL parameters with information such as the device MAC/IP.   You could filter based on this, concealing the splash page unless these URL params are present. ... View more