[candiddevmike]

RE: 1, you can push wifi clients to separate VLANs either by host or per SSID depending on the gear. It's enforced on the AP, clients can't breakout.

[andix]

By host is rather useless, because you can spoof hostnames and MAC addresses.