I would like to request 3 new features in the coming new firmware,
Outbound Custom Rules can select the source from WiFi Client instead of add each MAC address/IP address, since the OS already can check the client is from lan or wifi.
Dial in VPN client is manageable, assigned IP address and what the VPN client can access.
As adviced previously, recommended please isolate WIFI network from LAN then you can achieve as requested.
Engineering will consider the feasibility.
Schedule reboot is available for firmware 6.3.2 and above (support.cgi page).
Again the function should not use for the scenario as mentioned above. For the Webadmin access issue, please open a support ticket here for the team to further check.