While your approach to rotating the WPA2 shared secret (SSID passphrase) is efficient, it does have the drawbacks you mentioned. Fortunately, there are incident management tools to minimize the cost and downtime for your organization. We use Squadcast, and we've experienced a reduced client update burden. We're maintaining the existing SSID, and automation is also possible for runbooks.