We have so many devices (IoT and wintel, macs, androids, ios) spread across a few VLANs. Worried about any one device getting affected (e.g. Ransomware) and potentially infecting all other devices on the VLAN. Do you see this as a problem too? Any solution recommendation? Data centers are deploying micro-segmentation. Why not for campus?
Assuming that in many/all cases there's no requirement for individual wireless clients to communicate with each other (i.e. they only need to communicate with server devices and Ineternet sites), one option to consider for this would be Wireless Client Isolation.
This is a feature provided by some (generally more enterprise) wireless networking setups which stops clients from talking to other devices on the same VLAN apart from their default Gateway. For example this document from Cisco describes their approach.
That would work to prevent clients infecting other devices on the VLAN. Past that you'd need to make use of standard firewalling to ensure that clients could only get to approved local server serivces and out onto the Internet, and then ensure that your servers are well patched/protected, so that if ransomware does get onto the campus you're limiting what it can affect.