You just need something that can act as firewall betweent he 2 networks, say a Linux box, and then have different SSID for secure and china devices, and VLANs.

OpenWRT is a good thing to have on your APs.

VLAN and firewall are the things to google.

With all those “smart” devices (Including Internet of Crap), the rule of thumb is to put them on their own VLAN. Then put network filtering in place, such that nothing can talk out of this VLAN. And all you client devices that needs Internet access can then talk to them in the other VLAN.

You could allow specific destinations for them, but even DNS, it is better to just have a service exposed to them that only uses a hosts file to avoid VPN or exfiltration over DNS.

That is best practice. If you want to run a software update, you can open up, and update, and close down again.

Security is about being paranoid.