@Bebe1980 

Hey

As you have a controller this should be more than possible.  

1.You could create a seconds SSID, say CAFE and set it as a GUEST SSID.  Then create a second portal for this SSID and configure it as you require.   On the controller you could turn off the SSID for family tree on AP2 so it only broadcasts the new CAFE ssid.  That might work for you!

2.  A better option if you are willing to spend the money is putting in an Omada Switch and Router (ER605 and TL2008P should do it).  That way you can create a VLAN for the guest users to access the internet via a portal and on a separate IP Range from your home traffic.    EG.   Home on 192.168.10.x   and CAFE on 192.168.20.x  

The switch would allow you to put ACLs in place to stop traffic from the guests getting anywhere near your family/friends.    You could also then implement bandwidth controls on the guests to stop them killing you WAN connection.

This would be a much more elegant solution if you are willing to invest in hardware.

In terms of using MAC address filtering for the home devices, this is really really insecure and I would advise against it!  PPSK might also be an option for you, one SSID but multiple passkeys

  @Philbert 

Thanks I tried using two SSID's Free/PayingCafe but ACL on just the portal didn't appear to work... it seemed to stop the users connecting to the FreeFamilyWifi too...

So I'm trying it with two sites now, Cafe and Family:

So far Family users in (mac based) ACL can continue to use the AP to connect to Free SSID but need to login (it's on simple password atm) to PayingCafe Portal to use that.

Also users not in the Family ACL appear to be able to continue to connect to the AP's out the front not near the Cafe spot to connect to the Free SSID

Perhaps creating a second SITE creates something like a second virtual network, providing cleaner division of the services, equivalent to the latter physical solution you have suggested??

I was half expecting it to display two FreeFamilyWifi SSID's when I created the second SITE but it hasn't - I mean I don't get Family then Family2 on my wifi options or connection info - I just get Family.

MACID security - yes I know it's a bit of an oxymoron