Why not (and i realise that this is a dirty horrible hack) isolate those devices to their own dedicated virtual ap and isolated network. that way you get to restrict what they can talk to, what can talk to them and the keys that everyone else uses.<p>this also allows you to finally get around to rolling out eap so the scourge of shared wifi keys can die out :)