Hot Spot to be able to Authenticate from Routed IP subnet. Subnet that differs from hostspot interface IP Subnet.
AdminRich Baldry (Senior Product Manager, Network Security Group, Sophos Features & Ideas Laboratory) commented
Hotspot authentication relies on identifying the device by MAC address and associating that with a user. When a user is connecting from a device on a routed IP subnet the hotspot will not see the MAC address of the original device, but of the router interface.
Captive Portal will work in this situation because it is IP-based, but it doesn't control access to the actual WiFi.