For BYOD, I recommend 802.1X where your employees will connect to Wi-Fi and enter their work credentials. You can have radius assign them into a VLAN that can't access internal resources, and once the employee leaves the organization they won't be able to use their login anymore
... View more