An easier solution might be a two access point setup. Set the first router up how you want and throw it WPA encryption on the wireless. Set up the second router behind the first router with the restrictive firewall in place to stop P2P and keep the wireless on it open.

The double NAT on the open side will also kill off some things, but web and basic IM still work fine over such a setup.