To deploy a more secure/robust guest access the only option nowadays is to configure WPA3 Transition mode with Transition Disable, as there could be (and there are) lots of devices not supporting WPA3 to date becuase (1) they don't support SHA256 AKM or (2) the lack of support for 802.11w-PMF).
A more secure Guest access is that with a rotating PSK, this way you avoid outsiders who know the PSK to connect. This can be done with a simple Python script using random characters or predefined strings from a list, and autogenerate a QR code to be scanned for connectivity easyness.
Lastly, and very important if you are in the EU, is that you need to log user connectivity to be GDPR compliant, not all activity, but only the MAC address and/or valid email from those guests that use the guest access (the rest of information such as phone number would be personal information and that cannot be collected). This can be done with any Captive Portal solution, which does not provide a more secure access, but provides you with valid information to look at in case of any suspicious activity, or in case authorities request that. You can configure authorization for extended periods to all guests so they don't have to register every time, or use sponsor portals to grant semi-permanent or permanent periods to specific MAC addresses.
