will this lead to notably higher power consumption of the network device?
No. The password isn't used in literal. PBKDF2 is used on the password (with the SSID as salt and 4096 rounds of SHA1) to produce 64 hexadecimal digits = 256 bits, which are then used to derive the actual encryption key. Since that happens only once the password length has no impact.
What do captive portal uses under the hood ?
All HTTP/S connection attempts are redirected to the portal until the user has been authenticated. Normally, all other traffic is dropped prior to authentication.
How do they implement bandwidth restriction and FUP limits on users?
That's not done on the captive portal but on the firewall once the user is ...