At my previous organization I was the lead on a very large wireless project that was really driven by BYOD (K-12 School District). We utilized a Cisco 5508 WLAN controllers and 3602 AP's to provide coverage for just over 7,000 students and their devices (Some with 3 or more). We designed a "Guest" and "Student" network that would allow access to the web, would pass through a required content filter, and the devices could not communicate with one another. This network was also designed to be used by the public and community members who utilized these public school buildings for many community events and school events (Sports, theater, ect). As part of the design, we decided not to require any "Guest" software or "Guest" passcodes and left the networks unsecured (Since the clients didn't touch any internal resources and couldn't talk to each other, if a device came on infected or got infected while it was on the web, it wasn't going to affect anyone else's device). This eliminated a huge management issue for us - is a "Guest" network really usable and open if you always need a password to connect anyway?
Our biggest issue was access to internal resources, but since all students were utilizing Google Apps (Gmail, Drive, ect), required access to internal or intranet resources was very limited. For staff, they had organization owned and controlled equipment and were allowed on the secure network to gain access to internal resources and allowed to use their personal devices for Google Apps as well. Also, we provided VMWare View desktops to select users who only wished to use their personal devices.
