How about OPNSense on open hardware of your choice, and passing messy wireless to separate AP? OpenWRT is very good, but the installation and upgrades are not easy. There is a zoo of images for different hardware, installation options and tools. It has to run on small devices, so there are limitations. The documentation on Wiki is scattered and could be improved. I had to search forums for weeks for a custom package…
The solution is to use image-builder and bake your config into the image.