I have two networks:

One for only my approved devices, 5 GHz 802.11n/a only, WPA-2 encryption, MAC-limited, DHCP provided not by the router, but by a server that does MAC-and-hostname verification before assigning, and assigns non-approved devices IP addresses that are blocked from doing anything.

One for 'guest' devices, 2.4 GHz 802.11b only, limited to 2 Mbps (at the WiFi level,) no password, with complete separation from my 'internal' WiFi-and-Ethernet network, with filtering turned on (no torrenting, 'child filters' enabled for web, most ports blocked.) This is used for both guest use, and for older devices that can't do WPA (like the kids' Nintendo DS.)