I am thinking there must be some alternative better than passwords, but not so complex and difficult to administer as a full PKI infrastructure with client certificates on every device. My primary concern is to prevent malicious users from spoofing a device that belongs to someone else and then guessing the password. We want to prevent identity theft in the mobile application, which is processing financial transactions. Implementing too much security would negate the convenience of mobile access, and the users would not adopt a mobile centric workflow. Is there an alternative, a middle way?
It sounds like your real concern is at the application level. You could secure your connection via VPN; In this scenario you block access to the app from the network that is just the WiFi and require it only come from the VPN's network or other approved network. You may also consider, possibly in addition, using some type of HTTPS, TLS, etc at the transport or application layer to encrypt the connection. If you are doing financial stuff, this should have already been a requirement.
Just because you are on the network, one should not be able to just get to the app. If you were talking about getting the WPA2 password, requiring encryption at layer 3 or above can help that. If you were talking about breaking a user's application password, there should be controls in place to limit brute force attempts and to ensure complexity rules are sufficient.
If you provide more detail in your question, I will update this response.