Hi, we have the same issue (tested with iOS 15 RC) and as of now we haven'f found a viable way to use this feature.
The first time the phone opens the captive it never calls the user-portal-url, but we noticed that if we tap on the same SSID again after closing the captive portal, this time the captive re opens with the correct url.
It doesn't seem like this should be the correct behavior, as in Android it works as expected.
Thank you and best regards