You're closer than you think. Both symptoms are really the same symptom.
scg.ruckuswireless.com is the common name of the factory self-signed certificate SmartZone ships with. When SZ redirects an unauthenticated client to your external portal it passes its own identity in the query string as the sip parameter, and the WISPr reference guide says that if no certificate was ever uploaded, sip comes through as exactly that name. It doesn't resolve in public DNS.
Which explains the empty Access Tracker, and this is the bit that catches most people: ClearPass Guest never sends RADIUS in this design. Your Guest page collects the credentials and HTTP-POSTs them back to the controller at https://<sip>:9998/SubscriberPortal/hotspotlogin, where 9997 is HTTP and 9998 is HTTPS. Only then does SmartZone originate the Access-Request toward CPPM. Your POST is going to a hostname that doesn't resolve, so it dies in the browser, SmartZone is never asked to authenticate anyone, and no RADIUS is ever sent. Seeing /SubscriberPortal/hotspotlogin after you submit is normal, that's the submit target. It would only mean a wrong Logon URL if you landed there before login.
Best fix is to upload a real certificate to SmartZone under System > Certificates and then Certificate Mapping, with a CN your guest clients can actually resolve. As a stopgap you could add an internal DNS A record for scg.ruckuswireless.com pointing at the SZ control interface, though TLS on 9998 will still complain. Better still, build the form action dynamically the way the WISPr guide's own reference JavaScript does, falling back to apip when sshTunnelStatus is 0, which sidesteps DNS entirely. On the CPPM side that means enabling Dynamic Address on the web login page and permitting your SZ and AP subnets.
A few ClearPass Guest settings that matter for SmartZone: Vendor Settings as Custom, Login Method controller-initiated, Submit URL /SubscriberPortal/hotspotlogin with POST, Secure Login HTTPS, and Security Hash set to do not check. That last one is an Aruba-style URL hash, SmartZone doesn't compute one, and leaving it on will break the page. Pass url, proxy, uip and client_mac through as extra fields.
On the SmartZone side, confirm the WLAN authentication type is Hotspot (WISPr), since that's the only one that exposes an external Logon URL. Logon URL set to External, Smart Client Support to None, and your CPPM guest FQDN on 80/443 plus the SZ FQDN on 9997/9998 in the walled garden.
Quickest way to confirm all of this: open CPPM > Monitoring > Event Viewer and look for unknown NAD. If it's empty, no RADIUS ever left the SmartZone, which is the DNS problem above. If it shows entries, your portal POST is actually working and you simply have the wrong NAD IP defined, which comes down to whether your AAA is in proxy or non-proxy mode.