Separate Traffic

[New_Meraki]

Looking for the best solution to have non staff & students connect to our meraki APs and get out to the internet without having access to our network.

[cmr]

I have used a separate SSID in it's own VLAN that has a dedicated MX for it.  The VLAN has no interfaces on the main corporate network switches or MXs.  To be super secure you could make the SSID tunnel back to the separate MX.

[Brash]

This ^
Also setting firewall rules on the SSID to prevent communication to RFC 1918 IP Addresses.