The sweet spot in my opinion is to use an ordinary Linux box as the router and just wire up whatever wireless router(s) you have lying around for the APs (give them a static address in the appropriate subnet and you're done). No need to run OpenWRT on on the AP, since it's just mindlessly pushing packets around on the internal network.
For bonus points, block it from accessing the internet itself.
For bonus points, block it from accessing the internet itself.