Plenty of ways to force authentication.
You can run any of several different flavors of 802.1x.
You can put a proxy server, or a PIX or IOS router acting as a proxy, between the AP and the internet.
You can run NoCatAuth.
LEAP 802.1x, authenticating against a radius service running locally on the AP, is probably one of the more straightforward options.