My sibling comment covers what I've done at a high level, what seems to work really well to me is to use a separate router and AP so that the wifi side of things is completely divorced from managing the router. That'll let you use something like OPNSense, OpenWRT, or PFSense to manage the traffic. If you don't already have a device to do that I'd highly recommend looking at ServeTheHome's reviews of some of the N100/N300 based devices that have been coming out lately, there's quite a few really powerful ones coming out that would work wonderfully for this (I'm using a Ryzen based normal PC that I've optimized for power since those didn't exist when I did this).
Some recent reviews that give an idea of what's out there (look further too, there's a few 4x2.5GBe + 2x10GBe ones too)
I'm actually running mine with the router in a VM in proxmox with a PCI-e passthrough NIC because I'm also running a few other network critical services that I wanted more isolation on (omada controller, mail server, ldap, etc.) but don't want the power budget for yet another server.
Some recent reviews that give an idea of what's out there (look further too, there's a few 4x2.5GBe + 2x10GBe ones too)
https://www.servethehome.com/asrock-industrial-4x4-box-8840u...
I'm actually running mine with the router in a VM in proxmox with a PCI-e passthrough NIC because I'm also running a few other network critical services that I wanted more isolation on (omada controller, mail server, ldap, etc.) but don't want the power budget for yet another server.
EDIT: bah, wrong second link for STH, https://www.servethehome.com/everything-homelab-node-goes-1u...