The whole point of a hacker space is to allow people to do what they want with it with-in the extent of the law. Have people sign a legal document and be done with it. Don't put in unnecessary controls, this is not some large corporate company with stock holders and customers, it's a hackers space.
If you present someone with something like the vision statement from Noisebridge, this should not be an issue. "Our code of conduct is "Be excellent to each other". "https://www.noisebridge.net/wiki/Vision
Laying out these boundaries for people must be done upfront, and enforcement can be done later- if needed. Generally if someone is being an ASSHAT, the other members of the community will oust them from the space.
CCCKC has a packet that people must sign that includes indemnification stuff, I'm would be willing to contact the CCCKC resident lawyer to see if he could give us the template that he used. Then require new members to sign before becoming a member.
If you want to segment the network into VLANs so that people can play, I am all for that- eg: CTF network, infrastructure stuff (cameras, printers, computers for office, etc), public wired, darknet, and public wifi. I have several boxes laying around that could do PFSense just fine and handle all of these (I may even have an old Cisco Catalyst to do the VLANs).