My AP has a default "guest" ssid/vlan that has a weparate address block on it... I use that for untrusted devices.

It's a dedicated prosumer/commercial ap though.