Hello!
I have an pfSense Hardware Firewall which splits my WAN Traffic into two VLANs (private/public) and do the NAT. In a nutshell the Access Point has only to passthrough the traffic from the private-VLAN to WiFi and the builtin switch and the public-VLAN to WiFi-Guest, no additional NAT needed. Therefore cpu performance will not be an issue... Important is a very good 2.4G Signal strenght and a very good OpenWRT support! 5G would nice to have but not necessary atm.
Thanks & best regards 
If you don't need much CPU or blazing 5G, a used Archer C7 or A7 could be a good fit. The 2.4 range and performance on mine was good. The 5G performance was OK - not a fast as my EA8500 or EA6350, but certainly adequate. Also has 16/128 flash/memory and good OpenWrt support. Just be sure not to overpay - you should be able to find used for ~$25 shipped, and ideally less. The hardware is a little dated, but it still makes a good access point. The CPU will do ~135 Mbps SQM with CAKE - it's not going to set any speed records, but there are definitely more anemic options.
Hello
Thanks for your suggestion! I've already considered that. I would prefer the A7 because this model has external dualband antennas no inernal 2.4G antennas. What do you think of my plans? Technically it works with openwrt, right?
Best regards!
The C7 V5 is exactly the same hardware as an A7. The C7 V4 is very similar. In both of these the external antennas operate dual band.
You will find a lot of reference to the V2 as having "best OpenWrt compatibility," but that information is dated. The new builds for the V4 and V5 work fine.