Yes you can run radius on openwrt. You then need WPA2-enterprise (or wpa3-enterprise).
To setup a separate password per client without radius have a look at:
Individual per-passphrase Wifi VLANs using wpa_psk_file (no RADIUS required) - Installing and Using OpenWrt - OpenWrt Forum
That will authenticate per client, such that it will not be possible to just change mac address and reconnect for another 2 hours. But then I guess you need some kind of scripting that gets triggered on a DCHP request or something that e.g. starts a timer for 2 hours and at the end make a firewall rule to block forward to wan.