Secure access to church WiFi

To start out, you only need 2.4ghz Wireless G for IoT devices like controllers for HVAC. It should be a secured LAN/WIFI SSID, that no one can access. Using VLAN’s to separate IoT devices from regular use is the best way to go.

You would setup a separate Access Point for 2.4Ghz devices like IoT. Sitting down and mapping out on paper and the building plans or a drawing of the building floor plan helps you figure out where those devices like HVAC and controllers are, so that you can plan how to place the AP’s that are POE (Power Over Ethernet) for both 2.4ghz and 5ghz.

Look at snbforums.com and smallnetbuilder.com for more information on WIFI AP’s.

That may be a bit too complex for me! I may be the church's IT king, but only in the sense of the proverb "In the land of the blind, the one-eyed man is king!!

Thanks anyway.

Thanks for the good advice. I'll put it to the officials to see what they want - no public access, password protected limited access to those with an official need and accept the security aspects, or spend a bit of cash for a restricted public access.
Cash will usually win. We'll see.