"'m looking forward to the call when I help her set up her subnets"
Just like some routers have built-in "guest" networks, it wouldn't be difficult to add some pre-configured subnets and VLANs without requiring the user to have a good knowledge of what they are and how to configure them, and add an interface to add the required ACLs in a simple way, again with some pre-configured ones (i.e. "HTTPs traffic only"). Add on top of it DHCP/DNS automatic management, so you can also see which devices are registered, and with which names.
Call them "networks", "segments," "zones" or whatever you like, to help the user with simpler names.
Biting the hand that feeds IT
