If you implement client machine certs, then only corporate imaged machines can connect to 1 in the first place - wired or wireless. 2 and 3 are a bit same-y from my perspective, but the selling point might be “you get a bigger share of the office pipe than the totally open guest network, and fewer restrictions” for 2.