You need to use dynamic WEP key implementation such as LEAP to avoid having your clients type in a static WEP key.
I would create unique VLAN for clients alone, and have them use username/password to dynamicaly retrive dynamic WEP keys from RADIUS server.
Speaking of this solution, if multiple users use same userID from RADIUS server, will all these users share common WEP key and its rotation?