we went to the cafe to drop off the supplies. i noticed yesterday from the router's admin page that our neighbor was still able to connect to the guest wifi even though i turned it off. the problem was i only turned off wireless SSID broadcast: they couldn't see the network form the pulldown option but if they'd connected before, their device would be smart enough to connect to the "invisible" guest network which was technically still active. i tested it out by manually inputting the invisible wifi network and sure enough i was able to connect. so my latest fix is using access restrictions to set up a schedule where the wifi is only available during cafe hours and denied all other times. this affects anyone connected to the public IP addresses; they can still connect to the wifi, they just won't have internet access. when i checked the sys-info of the router, sure enough there was nobody on the guest network, but the private network was still working just fine.