It sounds like you've got things configured properly. For your OpenNet SSID, is your "Default Role" set to Un-registered in Provision > Wireless > SSID? And are you allowing any services in the policy for the Un-registered role (Provision > Roles > Roles)? If so, what are you allowing?
Thank you for 'jarring' my memory loose! As you as you mentioned to check the "Default Role", I realized I had assigned it a role, instead of selecting "Un-Registred". The system was just doing what I told it to do, assign a role if associated to the SSID and allow them to access a resource.
Thanks for the feedback!