I have run in to similar situations so I understand the issue. I have not done what you suggest with APs, but I have done it with 1310 bridges so I think it can be done - that is using an AP as a bridge and hardwiring the AP to the PC or a switch.
One of the ways I have gotten around this issue is to use the capability of multiple SSIDs to my advantage. I added an SSID to the AP just for the vendors and slapped access lists on their VLAN which severely limited their network access. The only issue I had was that I did not want to give them Internet access; however, without it they would not be able to apply patches and updates. In any case, I gave them a preshared WPA key but it was very restricted as to what they could see and would not work on any other APs at the plant. In any case, even if you type the key in yourself, it is possible to export that to another machine without knowing the key - at least that is the case with the Intel wireless client profiles and it is very easy to do. Hope this helps.
Randy
