I recommend replacing hostapd with an enterprise access point plugged directly into an ethernet port on the router. Most support VLAN tagging based on SSID, so you can still set up different subnets and firewall rules for the different SSIDs.

As much as I love hostapd... the performance using commodity hardware has always sucked for me. I can get 150MB/s over wifi with my proprietary AP!

Agreed. I also have had some good times with hostapd, and I've done a lot with commodity wifi hardware in the past (I'm known as the guy that was able to get WiFi working for PyCon when nobody else could). But these days I've been running a Ruckus R620 at home and it's been a huge improvement over 4 Google WiFi APs spread around the house with ethernet backhaul.