on USG

/config/scripts/radius_default_vlan.sh

#!/bin/bash


if grep -q "DEFAULT Auth-Type" "/etc/freeradius/users" ; then 
	exit 0
fi


cat >> /etc/freeradius/users <<EOF

DEFAULT Auth-Type := Accept
	Tunnel-Type             = 13,
	Tunnel-Medium-Type      = 6,
	Tunnel-Private-Group-Id = 1

EOF

service freeradius restart

chmod +x /config/scripts/radius_default_vlan.sh

on Controller/CloudKey

find the correct location of config.gateway.json for your site.

on a CloudKey Gen 1 I had to create the folder:

mkdir /srv/unifi/data/sites/default

config.gateway.json

{
	"system": {
		"task-scheduler": {
			"task": {
				"radius_default_vlan": {
					"crontab-spec": "*/5 * * * *",
					"executable": {
						"path": "/config/scripts/radius_default_vlan.sh"
					}
				}
			}
		}
	}
}

on Controller UI

force provision USG