separate the wifi network
I'm in the middle of trying to split our network into a public wifi lan and a private office lan that's entirely wired. Staff with devices will use a vpn to access office lan resources. There will be a proxy for printing, and possibly other services. Otherwise, they will use internet resources.
This arrangement's goal is to give wifi device users with a familiar internet-centered experience, and the desktop and laptop users a traditional lan-oriented experience. There's just not going to be a combination lan-over-wifi experience. Instead, they will get a vpn-over-the-internet experience, which is a little less convenient.