Bushfiva beat me to it!
I actually have 2 WAPs, purely because the boys' DSs don't support WPA.
Hence one WAP runs WEP, with SSID off, MAC Address filtering on, using fixed IP addresses (no DHCP) with a custom subnet mask to limit the number of devices on the subnet.
The other is WPA for everything else (including the Wii), again with MAC Address filtering on, using fixed IP addresses. I keep the SSID on so that visitors can connect easily (or as easily as non-DHCP can be).
SD