In a corporate environment, the best way to accomplish this is via certificates issued to copmany devices and possibly MAC addresses. Mind you, this can be beaten if the users have IT security know-how and critically if they have admin rights on their devices. Your company doesn't have a Windows AD server so I presume it would be rather difficult to setup an internal PKI for this.
There's an issue using RADIUS servers like FreeRadius with temporary passwords where laptops and mobile devices continue to try to connect automatically and usually end up locking the account due to an expired password, or using up server resources by processing erroneous login requests.
Hotels and general guest access is normally implemented using a wireless system with a Captive Portal (http://www.hitechmv.com/list-of-open-source-captive-portal-software-and-network-access-control-nac/). This is similar to when you connect to Starbucks or McDonalds without a pre-shared key but you get a webpage that you need to login or click through to get Internet access. This will give you the functionality you're looking for, but at the expense of convenience for the staff.
Ultimately, there's no best answer. It all depends on what level of control you actually have, how much you trust your users, and how important this actually is to the company. An flexible and fully featured system will cost time and/or money.
I understand what you mean about trust. What I meant was that since you don't have a directory server to control user machines centrally, you'll have to trust that your users won't abuse the system (if they do have admin rights).
As far as RADIUS goes, you'll need to configure Change of Authorisation (CoA). Without CoA, you can't end a session that is in progress and the new authorisation would only be applied to the next time the user tries to login.
In the case of 1) assuming you don't have CoA configured, if you block an ex-employee while their device is still connected, you can't kick them off the network just by disabling their user account. You would have to do it manually on the wireless access point by ending the session based on the MAC address. Next time they try to login, they would be blocked by a failed RADIUS authentication. If you do have CoA, then changing the privileges associated with the account might prompt an immediate change and kick them off.
For 2) that would depend on the wireless system. I have seen some that you can specify a maximum session duration, but there's no way to stop them from reconnecting immediately since the PSK is shared among all users on the same wireless network. You could do MAC address filtering but whether it's fine automatically or manually would depend on the wireless system or RADIUS server.
Implementing 2) with a captive portal is a lot easier because the authentication timer is usually done with an http session cookie that can be invalidated at any time, thus killing the user session.