My old apartment (built to rent) had a pretty sweet scheme. You connected to a shared WiFi network throughout the building and was put in VLAN 0 with all the ot

My old apartment (built to rent) had a pretty sweet scheme. You connected to a shared WiFi network throughout the building and was put in VLAN 0 with all the other unauthenticated devices, but once you signed in (captive portal) you were bumped in to your own private VLAN and you could only see / connect to your other devices. The only downside was any device where it wasn't convenient to login to the captive portal had to have its Mac address registered to your account.