Routing and CPE management/monitoring

I have a question for others who have already implemented routing in their respective distribution networks.

How do you continue to manage and monitor your respective CPE’s? I’d assume you’d create a private network for the CPE’s and route it through the network, and just create some rules at the core to drop those packets.

Otherwise how would you upgrade firmware (manage the CPE), monitor connectivity, throughput, and rssi/noise levels (SNMP)?

Just wanted to know if what I’m considering (routing two separate networks public and private) is the “norm” or if there is another way to go about this that I’m just not thinking of.

Basically my goal is to limit the amount of ARP/Broadcast packets on the wireless distribution LAN. And to provide for more security by doing packet filtering at the distribution level. But still maintain the level of monitoring and management I presently have.