Wifi is always an external network segment. Maybe run different SSIDs to make the use cases clearer or do some kind of QoS; however there isn't really enough s

Wifi is always an external network segment. Maybe run different SSIDs to make the use cases clearer or do some kind of QoS; however there isn't really enough spectrum (at least pre 6e) to worry about that in most places. May as well just use one outside the network AP for everyone, just an easy password everyone knows to prevent parking lot users. Entry to the corporate network? That'd be the VPN (or wireguard, etc) just as if they were off site.