>You can use a diy mini pc with OpnSense for a router along with a dedicated AP box... most commercial AP boxes can configure for separate SSIDs and VLAN configurations... this can allow you to monitor, configure and block certain access to the devices on your network into different trust groups.

Most routers nowadays support "guest networks", which typically disable LAN access. That's probably all you need, no need for VLANs or anything exotic.