Can Passbeam do guest Wi-Fi or a captive portal?

No captive portal, no splash page, no vouchers. Passbeam authenticates known devices and people against certificates; guests are by definition neither, and your access points almost certainly already do guest Wi-Fi better than a bolt-on would.

Where Passbeam does meet the guest case is on the wired side, and it matters more than it sounds: a network point in a meeting room is the one nobody thinks about. A port can hand out guest access by default and move a device onto the staff VLAN only once a certificate identifies it — so the socket is useful to a visitor and not a way onto the corporate network. That is a switch setting plus a VLAN rule here, written up in “How do I make a switch port default to Guest, but put authenticated devices on the staff VLAN?”.

Identity PSK — a different Wi-Fi password per device — is not something Passbeam does either. It exists to solve the same problem certificates solve, less well, and a product offering both would be arguing with itself.