Hi,
i tried to recreate your Situation.
It seems the Rules under "Restricted Subnet Access" only get appled if you enter a valid Guest Passcode. If not, you can only reach your Captive Portal which is the ZoneDirector itself.
Maybe someone has another idea how to solve your issue.
Best Regards
Marco