If you've got more mid-range network gear you might consider setting up a simple RADIUS system and switching to 802.1x auth (with just a basic guest portal or s

If you've got more mid-range network gear you might consider setting up a simple RADIUS system and switching to 802.1x auth (with just a basic guest portal or something for visitors) and per-port VLAN control as necessary. Makes it very convenient to segment out and isolate IoT, video, and VoIP into their own independent segments, best practice not just for security but performance and functionality as well. While it takes a bit more setting up it's also interesting and adds safety and versatility over time, plus you don't need any extra gear or cable. Worth a bit of consideration anyway if you have time and/or enjoy that sort of thing, along with a decent local VPN setup. The latter should also become even better over the next few years as WireGuard support spreads.