I would drop every wireless feature, connect it via lan to an vlan that can be reached to other vlans, but no internet access. The vlan is assigned via the router and is enforced by it.