I don't see how that would be possible as DNS requests are not technically linked to web requests in any way, other than that they are sometimes made in close temporal proximity to each other, but caching means this isn't always the case.

I could just visit 1.2.3.4 to reach the captive portal, but my question was more about "how can they allow based on SNI if that is encrypted too"?

Regardless of what DNS server is used, my connection requests to websites (whether to a real messaging site, or a faked xray one, or whatever) might be using ECH, so how could they allow the request in that case? I don't think they can control whether those messaging services are using ECH either.