If you have a Mac with a wired ethernet jack, an Airport base station capable of doing WPA2 Enterprise, and $20 (to buy macOS Server in the Mac App Store), you can set all this up! Then you will be able turn on and off access to your WiFi network, per user.
It’s that last bit that explains “why?” With Personal WPA2 Wi-Fi, everyone shares the same password. With Enterprise WPA2, each person has their own password. The RADIUS server is the key to making this happen.