Is there a way to disallow captive portal user in blue zone to share internet connection.
Don’t think that is possible.
You could rate limit there connections.
Or
Use Ipfires built-in Proxy
Another method (but possible to workaround) may be to set the TTL to 1 for end devices.