1 . is there a way to set it so you can have the user authenticate for the first time with the hotspot user name and password. Then get there mac and save it so they do not have to do that again.
2 . is there a way to take it one more step further have this all passed to a radius server so we can manage there macs and if we want to we can remove there mac and have them hit the hotspot page..
You can also do so on an external RADIUS server and a backend database with queries/DB queries customized that the RADIUS server inserts unfound MAC addresses into the database for subsequent authentication unless the entry is marked as to be denied.
However, either solution is going to take quite a bit of time to write (couple of hours at least) and would take as long to document, and asking someone to do what I would estimate to be around 6-8 hours of work for your custom case is a lot for a community forum.