Definitely recommend a separate 2.4ghz N-mode only wifi with separate passphrase and client isolation on a different vlan with routing only out to the internet for all IoT stuff.