I'll go through the points you have mentioned, and will add some extra points below as well
WEP? WPA? WPA2?
All of these schemes have flaws, but some more than others. The current best practice is to use WPA2-Enterprise with client certificates for each individual device. This way, even a rogue device will be unable to sniff traffic of other devices.
Of course, the drawback of this is that it adds a lot of complexity to configure, and not all consumer devices support WPA2-Enterprise.
Another good bet is using WPA2-PSK (Pre-Shared Key), which is what is usually referred to as just "WPA2". The security of this system is a bit more limited, and suffers from a fundamental problem of symmetric encryption, namely that all those who know the key can decrypt messages.
Concretely, this means that a compromised device (or an attacker who gained knowledge of the key through other means) can read the network traffic the same way as if it were unencrypted.
This may sound dramatic, but it's something we have to live with. In order to ensure an attacker can't crack your key by sniffing a handshake and bruteforcing it, you have to make sure your key is long and random, such as MN7s>R]nGAdg&m3vMnw:"4gv. Yes, it'll be a pain in the butt to enter it on a Nintendo Switch, but at least you only have to do it once.
As far as AES vs. TKIP go - if your particular access point allows you to configure that - always go for AES. TKIP is flawed and should not be used.
Should you hide the network name?
No, it doesn't add any extra security. It doesn't "hide" your network as it is often portrayed, it only masks the name. The network still broadcasts its existance.
Furthermore, any client that knows the SSID will continuously broadcast the SSID. If you ever looked at a the client list of airodump-ng and wondered why sometimes you can see names of people's home network - this is why.
Finally, it doesn't prevent any attacks. None.
What about UPnP?
Disable it. Most routers have an option to disable it, and if yours doesn't, demand a replacement or install a replacement firmware.
Should I set up a guest network?
Most likely not. The security of most guest networks is terrible. They are designed to be open networks, with a login page shimmed in to "authenticate" people. Since they are open, and those login pages never use HTTPS because of certificate issues, an attacker can simply listen for someone connecting and then use their login data. Or spoof their MAC - in most cases that works too.
You could, theoretically, have a guest network that is secured by WPA2-PSK and have a login page, which makes it somewhat better. In that case, it may be something you can consider.
As far as IoT devices go, look into VLAN options. DD-WRT, for instance, allows you to create VLANs for various clients. Is it perfect? No, but it at least offers an attempt of segregation.
Should I turn off WPS?
Yes. The S in WPS stands for "Excrement", if you see where I am heading it. It is truely terrible and should never be used.
What else?
Setting up your own device behind hardware provided by your ISP is a good idea. Just make sure that you disable the Wi-Fi in the modem/access point/router-thing that your ISP gave you, and set it to Bridged mode.
Setup a guest network for guests and IOTs
Turn off WPS
???
