By default, HTTPS connections are encrypted and you can't pass them through a proxy... what you could do is filter them by the destination IP, by allowing only some addresses and denying everything else using the firewall; however some servers use virtual hosts and host different websites under the same IP, so if the same server hosts both a whitelisted site and a blacklisted one you can't block only one of them.
However, a solution is to have the user's consent to configure the Squid server's IP to be the browser's proxy, in which case the traffic is still encrypted (it will be tunneled using
CONNECT requests through the proxy) but the destination hostname will be in plaintext and you will be able to apply ACLs to that.
So a possible solution would be to redirect all HTTP traffic to a page explaining how to set the proxy server's address on the device, and block direct HTTPS traffic. Once users configure the proxy on their device, they'll be able to browse the web by your rules.
Oh and irrelevant to your question, but instead of obnoxious captive portals, have you considered using EAP to authenticate your users (and provide an open network only for new users to register and get their EAP credentials) ?