I do DHCP reservations then firewall rules. Not as safe as a VLAN but not aware of any devices assigning themselves random IPs outside the DHCP reservation to circumvent it

Easier than getting VLANs working across switches and APs