Doing RADIUS certs with Windows Server is just a pain every time I go to do it. Mostly lack of a good how to that covers the subset of what is needed to use RADIUS to get on the WiFi. The MS docs cover the kitchen sink, the patio and the front yard. And since I’m not a RADIUS practitioner, I’m never certain if I made a secure thing. (I guess the answer is no with the recent RADIUS design flaw disclosure). Perfect space for an appliance IMO, once RADIUS is cleaned up. I think any security-minded SMB will want to stop using WPA2 for WiFi authentication. I know we have one firewalled as a guest network, always getting hammered on from the outside.

Can’t really advise what makes a good MVP for your effort. But if I could buy a box that was set and forget for this function, kept itself patched, complained when it couldn’t and wasn’t too expensive, I could acquire one where I work.