This now somewhat exceeds the scope and may be unnecessarily paranoid, but I personally also recommend RADIUS authentication for the switch ports that lead outside to the APs. Most managed switches support at least a simple form of this. If you buy a 24-port switch, it probably supports that as well. Otherwise, just take a look at the data sheet. The manual usually explains how to configure it. This ensures that no device other than the access point can be connected to the network cable. Otherwise, anyone could plug the cable into their computer and compromise your network. However, someone would have to enter your garden and dismantle the access point for that to happen. An unlikely scenario, but the possibility exists. We will implement this since we have routed several LAN cables outside (doorbell, access point, wallbox, garden shed, etc.).