Multiple SSID and Captive Portal

Our customer asks for advanced Captive portal that would act depending on SSID/WLAN. They need to segregate users into three classes: Best Effort users, First Class users and Staff users. User classes are already available on HD2, but we cannot distinguish users coming from SSID1 or SSID 2 - both are presented the very same Captive Portal login and QoS in terms of allowed throughput.
We need something like this:
SSID1 - Captive Portal active, for free access, no credentials required, with QoS1 (assume, quest access, Down: 200 kbps, Up: 50 kbps, Lowest priority)
SSID2 - Captive Portal active, user enters credentials for authenticated access, with QoS2, where QoS2 > QoS1 (assume, First Class group - Down: 2 Mbps, Up: 2 Mbps, Medium priority)
LAN users - for authenticated access, with QoS3 > QoS2 (Staff group, Unlimited access, all traffic with Highest priority, no Captive Portal)