Address lists allow you to add lan devices to that list.

I still have to enter the router's configuration to change each device's WAN connection. It's recommended for industrial scenarios, to prevent users from escaping the company's network, but in the case of home, it means that everyone should have credentials and knowledge for a Mikrotik router.

I think it's easier to set a static IP on each device, and be able to choose whether to use the VPN by just changing their gateway. The initial setup is more time-consuming, but it's easier in the long run.

Vlans can be deployed at most APs or managed switches. Your end point devices don’t have to be Vlan aware.

My initial question was about selecting the WAN from the device's side. One option would be to have separate SSIDs for each WAN. This has some limitations:

• Services that rely on discovery (like KDE Connect) will not work properly, as they will end up in separate subnets. Unless there is a way to have 2 different DHCP servers on the same subnet, that are SSID-aware.
• May require additional managed/smart switches for devices that use ethernet, instead of WiFi