Captive Portal detection causing phones to disconnect from Wi-Fi in intranet environment
We had a similar problem but I think it is not exactly the same problem.

We had an Galaxy S5 mini with Android 5.5.1 installed. We also have a "filter for websites" to deny access to some websites.
The problem here was that after starting the phone it connected and then disconnected immediately from network.
We found out that the network connectivity check is the problem. First tests show:


When there is unrestricted Internet access it works.
When there is no Internet access, network connection stays up. "No Internet connection" means we blocked all traffic on the firewall and all requests result in a timeout error.


When analysing more deeply and looking at the android source code we could identify the HTTP return code as problem. The device starts an HTTP request to connectivitycheck.android.com. This resulted in an HTTP 302 (moved temporarily) from our webfilter. Knowing this we did further tests:


webfilter redirects access to connectivitycheck.android.com via HTTP/302 and all other internet sites are directly allowed: Here network connection was shut down again.
deny access to connectivitycheck.android.com using firewall (therefore timeout for connectivity check) and all other internet sites are directly allowed: Here network connection stays up.


Therefore at the end we had two ways to fix the situation:


allowing access to connectivitycheck.android.com without webfilter (therefore no HTTP 302)
deny access to connectivitycheck.android.com on the firewall


But what about other Android versions? I did the same tests using a Galaxy S7 with Android 6.0.1. Here we never saw any problem. In Android 6 the connectivity check was slightly changed and is not suffering the above problem.