Can be done by not assigning an IP to the WiFi nic but to the bridged Virtual nic in a KVM for say a PFsense firewall box. just having the lan vmbr with an IP so you can manage it. but I'm sure that you'll get plenty of people saying it's not a good idea to expose the host NIC (blank IP or not)...