I've started deploying purpose-specific APs that I simply plug and unplug as I see fit.
So, for instance, if I want to use tor, I have an actual tor ap that is normally powered off. I plug in the PoE connection and a bit later I have an SSID that is Tor only.
I also have a "guest users" AP that has no password at all. Plug it in when needed. Unplug when people leave. Shrug.
I use the Ubiquiti frisbee APs that are PoE. Sometimes I insert a "slug"[1] between the switch and the AP which strictly enforces their purpose - like hard locking them to a VPN.
So, for instance, if I want to use tor, I have an actual tor ap that is normally powered off. I plug in the PoE connection and a bit later I have an SSID that is Tor only.
I also have a "guest users" AP that has no password at all. Plug it in when needed. Unplug when people leave. Shrug.
I use the Ubiquiti frisbee APs that are PoE. Sometimes I insert a "slug"[1] between the switch and the AP which strictly enforces their purpose - like hard locking them to a VPN.
[1] https://john.kozubik.com/pub/NetworkSlug/tip.html