I'm going to assume your goals are the following:
- Prevent unauthorized access to the WiFi AP.
- Maintain the confidentiality of traffic between WiFi clients and the AP.
- Maintain the integrity of traffic between WiFi clients and the AP.
- Allow multiple users to authenticate to the AP with different credentials.
RADIUS implements goals #1 and #4, but not in the way that you might expect. In traditional 802.11 authentication, the client sends an authentication key to the AP, which verifies it and, if correct, allows the client to connect. The actual key exchange is more complicated, and varies depending on what security protocol you're using (e.g. WEP, WPA, WPA2), but that's somewhat irrelevant to our scenario.
RADIUS sits on top of these protocols, acting as a credential provider. With RADIUS, the AP sends all authentication requests over to the RADIUS server (usually via wired ethernet) responsible for managing the AP. One of the major benefits of RADIUS is that different users can log in with different credentials, and all attempts can be logged and audited. Some configurations allow for client certificates as an authentication mechanism, which is much stronger than traditional passwords. However, the use of RADIUS does not solve #2 and #3, because the underlying security protocols (WPA / WPA2) are flawed, allowing traffic to be sniffed, decrypted and (in certain scenarios) modified by authenticated clients.
In order to fulfill goals #2 and #3, you need to implement IPsec on your network. IPsec acts as an end-to-end cryptography mechanism at the Internet layer (i.e. IP layer), providing confidentiality, integrity and authenticity. Authentication is part of IPsec, so it partially supercedes RADIUS in this purpose.
In any case, IPsec should act as a strong authentication mechanism, using client certificates. Further security via RADIUS is a good thing, because it allows the following benefits:
- Protection from standard WiFi cracking attempts.
- A credential store for VPNs, remote NAS, etc.
- Full audit / logging for device authentication on the AP.
In terms of your last question, "can I do this on a home AP?", it depends. Almost all will allow for RADIUS, but I'm not sure how many will support IPsec. RADIUS on its own will not prevent sniffing between legitimate clients, but it will provide a barrier to unauthenticated clients. You need IPsec to enforce confidentiality.