One thing I realized is that you can share several safe internet sites on a public SSID.

For example you could share Google and duckduckgo searches you can also share Wikipedia. You can also share access to well known VPN services.

So you put in an iptables rules for the guest SSID interface.

This is not a fully open net and all respect to those who build it but I am a bit affraid what sites users might surf on and as it now law enforcement assume ip==user who did things.