When a device tries to connect to the MAIN network, an option for approval by the admin would be helpful before allowing internet access. But that a guest network would automatically be allowed access.