I haven’t yet tested this myself, though I will probably be doing so in the near future for a similar project. I think it’s helpful if you realize that hotspot and capsman are not connected or related functions, and actually have nothing to do with each other.
I believe the correct solution would be to assign a master and a slave configuration to your CAP provisioning profile, action=create dynamic enabled. Make sure that each configuration is assigned to a separate interface or bridge on the CAPsMan (aka the DataPath settings), then install / setup the hotspot on that particular interface or bridge. The hotspot itself has nothing to do with CAPsMan, it’s simply running on a specified interface, and CAPsMan’s role only functions to connect the client to that interface.
When you have a working setup for this would you be so kind as to post it. I had tries to do something similar with a trio of networks as VLANs and VirtualAPs (employee / secure POS / customer and guest Hotspot) and it doesn’t really seem to function as I would expect. I set it aside until I could work on it again but and that time has arrived.