Many APs now support either using Radius and username/password auth for this, or having multiple acceptable pass phrases for a WPA2 network which drop devices into different VLANs.