Others may chime in with other ways to do this, but here is one that should work.
The hs-unauth chain on the firewall NAT tab I believe would be where you would want to catch that 8000 traffic and handle it with other traffic going to the walled garden proxy on TCP 64874. You could copy the existing port 80, 3128 or 8080 IP->Firewall->NAT entries related to the hs-unauth chain that redirect to 64874 and set the port to 8000.