Technically, the “best” option would be to VLAN the WiFi network separately from a wired network where all the important devices are connected.
But honestly, for normal people, that’s over the top. Try WPA3 first and see if you have any devices that won’t work over it. If you run into issues, swap over to WPA2. I generally say start stricter and loosen the metaphorical belt only as necessary.
Technically, the “best” option would be to VLAN the WiFi network separately from a wired network where all the important devices are connected.
But honestly, for normal people, that’s over the top. Try WPA3 first and see if you have any devices that won’t work over it. If you run into issues, swap over to WPA2. I generally say start stricter and loosen the metaphorical belt only as necessary.