There are different types of authentication (802.1x) that you can use in conjuction with WPA/WPA2, if you don't want to use a pre-shared key. If the AP supports these authentication methods, you can set the CPE to associate with a username/password rather than one preshared key. These are authenticated against RADIUS at the AP level, and this controls associations.
The current AP software does not include the 802.1x features yet in the wireless security, but it will be added soon. What will the configuration of your AP look like? Will it just be an AP in bridge mode, or will it have any other configurations?