reply to VCWireless
Re: Total subscriber isolation Is your network entirely flat (bridged)?
Some AP's have the ability for client isolation which will keep CPE's from talking to one another through the AP. It will not isolate customers on a different AP if they are on the same Broadcast domain.
Routing the network (if you aren't already)
VLAN's (I would use 1 vlan per AP, and enable client isolation on the AP)
I'm sure there are a number of other ways. It will depend on the underlying network and how it is laid out as to which will/wont work.
I survived Hale-Bopp!
Rhaas - Yes currently our entire network is bridged. Thanks for the suggestion - I will pass that along to my Cisco guy